Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 19:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://notifications.heroku.com
Resource
win10v2004-20240426-en
General
-
Target
http://notifications.heroku.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613972224447882" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2468 chrome.exe 2468 chrome.exe 4456 chrome.exe 4456 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe Token: SeShutdownPrivilege 2468 chrome.exe Token: SeCreatePagefilePrivilege 2468 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe 2468 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2816 2468 chrome.exe 83 PID 2468 wrote to memory of 2816 2468 chrome.exe 83 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 1404 2468 chrome.exe 84 PID 2468 wrote to memory of 2700 2468 chrome.exe 85 PID 2468 wrote to memory of 2700 2468 chrome.exe 85 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86 PID 2468 wrote to memory of 4748 2468 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://notifications.heroku.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe8acab58,0x7fffe8acab68,0x7fffe8acab782⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:22⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:82⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3064 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:82⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:82⤵PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4308 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3924 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4124 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1532 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:12⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4328 --field-trial-handle=1820,i,13952738019728166647,6595557531336613532,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3452cb73-da21-4c59-b5c7-187cc1514df0.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
852B
MD5a851b3ea9d86e33167a0f2d3ef7afd98
SHA15e7bdc55118b84d9b6c59df4c71b53e0aad28cca
SHA256267fcbf15ca305fa0034a4fc9b7426aae4c95afd2a47fb1ad02cef875fdc0236
SHA51258926017580cb55f55f344cdaa7a9823aded53e7784ea242a8995479b80de775e84563f1f1332fd5cbd516faaec4d1c46bbe946b1cfeffd8acbeaa87a5b62a80
-
Filesize
7KB
MD5de59b30e6162e5404ad611acbe0d43d5
SHA1cb29f9042047096a5f665d6cb03e29063189d6d2
SHA25634cb6784e878548e8e8ba36f4f0e413f828a967f5602bcfc1247871a477d24cd
SHA5123d1bc2150ca6cf2fd80fc9d966d86b2a3b3cc8bd8555acad2a19d5b22a9fb39ce7bafe8cfdc92b77d7a424b60d75d2caffc130c4435881d224a599f5e5d1dadb
-
Filesize
130KB
MD5d897e83d3949961e5b37272ea0877a3b
SHA1611a8011de547752f51a7c9b55b9a0a75574858e
SHA25607c693ad6801f158b6b59f4b4673aef3c3fc6ae3a765a7272be0d567ba32c105
SHA512768e530cdba79d4505fc0ea8c501906b71920e06bea3edec6ae2a021c9291c866d487273b65bf94438b1b5790790ab7f2ea06eae646a9498b7e8d7267cf820f5