Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 08:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://update.dl-files.com/update/svcmain/193/svcmain_x64.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
1800 seconds
General
-
Target
http://update.dl-files.com/update/svcmain/193/svcmain_x64.exe
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2524 svcmain_x64.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613593625341742" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 5068 3332 chrome.exe 83 PID 3332 wrote to memory of 5068 3332 chrome.exe 83 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 696 3332 chrome.exe 85 PID 3332 wrote to memory of 940 3332 chrome.exe 86 PID 3332 wrote to memory of 940 3332 chrome.exe 86 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87 PID 3332 wrote to memory of 1488 3332 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://update.dl-files.com/update/svcmain/193/svcmain_x64.exe1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1b97ab58,0x7fff1b97ab68,0x7fff1b97ab782⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:22⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:12⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4764 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4776 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5096 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4884 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:64
-
-
C:\Users\Admin\Downloads\svcmain_x64.exe"C:\Users\Admin\Downloads\svcmain_x64.exe"2⤵
- Executes dropped EXE
PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1856,i,8600733375718114695,10203607217538971180,131072 /prefetch:82⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD56e30621dbef1f54e8cdd1d210c34fa12
SHA179b6ef032d90014863e96ecfdb3fb871814353eb
SHA2567834e3fb867fc7533234b600806240ae9d2623f6b6f3c6f341bd21fc0401f6fc
SHA5127aa846862db29d5d8e1c33d9be2dc72817578f393816ad31e14ac81725eb00da52fb398f54a2f590735045874da6081524c6f30606fbe9688ec26d3ea38eb642
-
Filesize
131KB
MD5b1104d8f491b31de2d7c163cee23dd42
SHA1eb880604724661c094abf6cf090458dfa5fde7f4
SHA25697a17ad140d80ef837166b3ee88931c8c6a38c4f016037abe1aaa2c2ffadf2f3
SHA51236883e80d87ffda85b937c7d26e8e7bcc46151f5b57494b11338986490a58db103337f48f889d18aa94a2f7b28fa3d900f70c2827a7925ebdf1dd85c7cbc9288
-
Filesize
132KB
MD5278948422b3a6cb06736ff47ead43324
SHA1e6bab7a3530d421a81cef7e068848cb3c980c328
SHA256c0256085580ee7214c20339ceeaf770fca1b5571b59e395f43626f434a803abb
SHA5124a715bba74ac6646ac07c7c59eeeafc7892407e01e06ca5116e02e12d059fa9f63ed710a4ce8c342f43133aa0b14865ff5a5da46fac4dd456e6eec2c9e5a6e36
-
Filesize
104KB
MD58b7292a1da86cab3e0bd567006d03463
SHA1e211cf89d24cdd7a5d1bb317d557e9a404198861
SHA2562f81786674b1f676d4fc3fbf2025afc21dc8c2360e4183495207e3aa51d62d03
SHA5124766e1e4a6e650905b09c7eda215b8c17c5d6e85a8a509e8a06b1c79b5dd8df27631603eedc5bfbb93f15e7bc37efecc74e6bc7686cffc958c790e4834c15f77
-
Filesize
101KB
MD5c3f26230a5e08c5e818f1869494aecf6
SHA1a7fcdda5ba28164034a244f0ef5f7bc55e654e66
SHA256b1c885e785aa39ab3f27387523b2ede22eb09c29b05700f7101f63f63a9b756f
SHA512e7a33114906af06a7a1879e0b89494594f26672bea7544ceafdaf985028d339a2fb16930fc0464f4af3c2817817b84a76139808264186faaa0ccf7871671e140
-
Filesize
501KB
MD5a82802d67b87a73f434e4419a9ba14f2
SHA1ebd18235a60a6124e94b11db2fe9693066651fe9
SHA256808e66a18410ce721c80fb1e60a75b70183d93e220c3aee63e2a0d41d81b5a38
SHA512fa3234ccb2a67fd42c1212440049fdd0e495fe3efbe2f2a243d46ad00e7d798c7422714172c2f73b900bf8c54de07d8bc7886bda7a74ed45af42eaa29611af19