Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
510s -
max time network
511s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 12:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://johndeere.copsoq.de
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://johndeere.copsoq.de
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612871752434321" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4508 chrome.exe 4508 chrome.exe 736 chrome.exe 736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1416 4508 chrome.exe 82 PID 4508 wrote to memory of 1416 4508 chrome.exe 82 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 932 4508 chrome.exe 86 PID 4508 wrote to memory of 4812 4508 chrome.exe 87 PID 4508 wrote to memory of 4812 4508 chrome.exe 87 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88 PID 4508 wrote to memory of 1928 4508 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://johndeere.copsoq.de1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb610fab58,0x7ffb610fab68,0x7ffb610fab782⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:22⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:82⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:82⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4528 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3292 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3996 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=212 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4308 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2284 --field-trial-handle=1924,i,16832900896967144282,7637511984525831071,131072 /prefetch:12⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:60
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\27cb15a5-bc6c-4c0a-b279-174868a5ff42.tmp
Filesize7KB
MD5a4a81dc43b480fceb4741aab8d0def40
SHA1a49d9c13897d7c1023b6ab0a1bfea94b8b93b4d6
SHA256564ebc90c9a1dbd808e8c14220117a2c92fb8fd060db64984a5fc1b2600c8da5
SHA51295a46028c25e3e6f26797e7460a0062a1a102d6a31d5d0c72089659cfeb8f16705777f26c471ed6c7c0fcde7fc3cc3c7b98ab15e6673b9e8d63484ad5c6f8c49
-
Filesize
1KB
MD56d7fd181f13c3b87368b52bf4297d49e
SHA1c7d1f49073b95ba01a87632fc50d0166fd28e7a5
SHA256e5b39ee47a0594193140b4bdaddb151bfc06f8dae02fcbe205662b10de27db58
SHA5120443c1f02e60983ceee5e85d01334e9a54b6add64688a521e61c789986f592fa53a591d59128d5f77a66827cf14e2a63202163f4c32fa2c675a8b7925c7ba275
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD580a391b67a8f4f46a545a4af0eca1335
SHA117d9ca16d73d2dfc0fd8125428b62f17b5035b56
SHA2562ef5b3fdbc543b34fbd4216f10a73b338d9128184f9d2be0e1ae42f61118f39d
SHA512463edafb5dba3dcbba30275fa6138d6d56f7f3dfa98dd1acf98d2a47b8cb4c2161d931e20e653698667cf161b4ef5e4debb552718af4f71179e13943903725f8
-
Filesize
255KB
MD5186143e8de55beb07a02fe6419f06f66
SHA1d898c2626e8a2da8cf4432038dd5a8d2459d94df
SHA2563b6831228d2d5f0724a3b410a641d13b048c7f139946fead6fe40701f97d0d93
SHA512be15013f43583898879de75137374e2d3cbf41e0b7faa0194ba17c16fad87bda9d9750e0a986648a502c42b2efca453d8fc789402123449823621bfcbdc9a67c