Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
210s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 11:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://driveitdigital.in/bmc/wp-content/uploads/2017/11/chinese_flag.jpg
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://driveitdigital.in/bmc/wp-content/uploads/2017/11/chinese_flag.jpg
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://driveitdigital.in/bmc/wp-content/uploads/2017/11/chinese_flag.jpg
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133614548970911629" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 4820 chrome.exe 4820 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4872 2132 chrome.exe 82 PID 2132 wrote to memory of 4872 2132 chrome.exe 82 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1156 2132 chrome.exe 84 PID 2132 wrote to memory of 1212 2132 chrome.exe 85 PID 2132 wrote to memory of 1212 2132 chrome.exe 85 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86 PID 2132 wrote to memory of 3616 2132 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://driveitdigital.in/bmc/wp-content/uploads/2017/11/chinese_flag.jpg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dcab58,0x7ff9a1dcab68,0x7ff9a1dcab782⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:22⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:12⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:12⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1716 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:12⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3460 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:12⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2452 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4260 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=1848,i,15082724624516246901,10709480508050176325,131072 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852B
MD557a6498fe9f3132c9149ee860c5e4163
SHA19e104a3762f62d253be56e7490a414a282ad2416
SHA25628a4b945c1a3278609d24e57f091c8ede87c7d16d7d41be872456b0adb0ad70b
SHA51297fb7084c516d9e1802bb9c1768d926855b2efa12cf6df5459ae1b23ab052c12f33c6973bc409eaac9134cd2cdf49294799029c01888d30eeac7c3fa592033de
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD500e71ef293436c36034044c3078c671f
SHA165c7860a096433c798dbfb3e2dd60d7b8b32a9ea
SHA256ca25ae1937615652345cd2a5e8f907b402ecc780d450167cbd5353e87b15ea95
SHA512179e909adc23296ba8009568c84aebff32362d51a29113b7bd0b70ed7c74583b99a7857a92dac97d985fdf3d9527d34085495a6c5dbdbf821e23d20dd822100f
-
Filesize
7KB
MD592bf32a3daf40d3d3b7a46cd980a4289
SHA1e2b3d0ad33390fd77fa1d6f760b60a9d763b53e9
SHA256a1bc393feab8a37defbd587efd7b4d211e8eee23d1d7c129ebd0f76b478732dc
SHA5123c02c4d6ddbbe28b5ae1d6ba6c3ee68cee6060767cf8d8e6f163bd4b8071450c2ee511ebc9ce202ce1607f475765dc074d2bc0753a02da17583f17256723893e
-
Filesize
7KB
MD5b79ab83947c50cafc21fa97bb78ac8ef
SHA15554516808ec1b96ff4bb1a313d662e49e2d85a7
SHA25670bf564d86d3bf405e0a053dc3b4a41b2c78e5a414e0dddadd2b691b0c55361c
SHA512decb359dbefe402feebb490202e5c98fb017cd1d8f7f9d30150fc2e06ee1e218fd5b3bb0929cd96ea8ea2094c03f6932c58a043dbb8a0e0eaccb5e839f8313ca
-
Filesize
130KB
MD5c7b74498a6b766b581140115a769a525
SHA1703600c6115c7c49f7aa8460e2cb283488157d4b
SHA25696dda2ba5697a4cc14c78f0982a02f59f80170ed76133d0d44fade1f80e07afa
SHA512fbf390edac297441b0ae8ed77bd65307ca79179fe158a27312c82f46e040646a62f4165558d792873aa80bf9b7c842cd324632de9ccb44b6b9adff4883873678
-
Filesize
130KB
MD53bb8f621d54a4d89ccffbde805aae51f
SHA1a2a88b2e60f9048e4adc7037b15f158a5fa8c597
SHA2564ec6df5eac02f3aea85cff5cf400ce7971034e4b864d0b19a8d16c59cdcd1dc3
SHA5121b71103516a4b62e38c7f212bf2257ac395c2a10e2c979d3b328b81abb08d4349342ebb7c5fff723d34c10ee54a220522b97149a997477da244617508568033f