Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
40s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/06/2024, 00:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNTE4MzY5NjA0Mg==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9aGlib0Bib2xvZ2lzdGljcy5jby5rcg==&TElTVF9UQUJMRT1FQkFEMDY2MA==&UE9TVF9JRD0yMDI0MDYwMzEwMDAxNjIyOTk0MA==&VEM9MjAyNDA2MTc=&S0lORD1P
Resource
win11-20240508-en
General
-
Target
https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNTE4MzY5NjA0Mg==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9aGlib0Bib2xvZ2lzdGljcy5jby5rcg==&TElTVF9UQUJMRT1FQkFEMDY2MA==&UE9TVF9JRD0yMDI0MDYwMzEwMDAxNjIyOTk0MA==&VEM9MjAyNDA2MTc=&S0lORD1P
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618491327578911" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2720 chrome.exe 2720 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2720 chrome.exe 2720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 5112 2720 chrome.exe 77 PID 2720 wrote to memory of 5112 2720 chrome.exe 77 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 3516 2720 chrome.exe 78 PID 2720 wrote to memory of 2092 2720 chrome.exe 79 PID 2720 wrote to memory of 2092 2720 chrome.exe 79 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80 PID 2720 wrote to memory of 248 2720 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNTE4MzY5NjA0Mg==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9aGlib0Bib2xvZ2lzdGljcy5jby5rcg==&TElTVF9UQUJMRT1FQkFEMDY2MA==&UE9TVF9JRD0yMDI0MDYwMzEwMDAxNjIyOTk0MA==&VEM9MjAyNDA2MTc=&S0lORD1P1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc018ab58,0x7fffc018ab68,0x7fffc018ab782⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:22⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:82⤵PID:248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:12⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3256 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4392 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:82⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 --field-trial-handle=1804,i,10714000688442563695,6812820620284940329,131072 /prefetch:82⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD57b86be4978cad63638143d24690bae3f
SHA1d3185e8236c2045f74e1061c95b21aa4012fe75f
SHA256f97b4954f14b31a70369d59558f7cdaa67ae6615749a19266153f5a0d2487354
SHA512887fb40615081181246cf978dccdf108e57c6830fcdca3ba2e5a78943ba7b11bd5fdd140d8f4bebab403e8c2908c1a59de76cf278e5c83694efc048ab33be1ed
-
Filesize
1KB
MD559ce22672ee619b716eb04241e807d8b
SHA1d2341839b9d24fbc7a6cf65715b8bcab25d67aa0
SHA2563bba3743f9f8ffa9d912d0bbd28983d1981a251bbb54dea84312614f66fcda84
SHA512cf5a57891dd72816c1ce2f86e946f4c14a6845ed94b5e165a656d28c405a2aabe4a7d5ecedb5737303af7af70f7bdc5771b721cf937c142273dbd166145511c9
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD5948bf4b34a5f5055604b23786e134cc9
SHA153f421cd46b0909d2d08e56a4b93b0bdbd179538
SHA256ad1868e85b36e371cd23795ddffaf440165f284e27feeed10b5d02a90145a540
SHA51205984c9d1ab2ad9732a2c8c0a00101c4c2b7920079fc11187f1788683a0c3de424490c7c597278c3a68df03aac9d2aefcebd870a984ac691bba869879b2d2978
-
Filesize
7KB
MD5c8372bb32f795d1921e4a99a78016633
SHA10ced042f73bca98f48152fdab2a16e30a3ffacb7
SHA25647ce2f894b10b8d47fb57fc1a0550fb4c34930a508ceffcd41f1f19e7fc849af
SHA512b4a17816dee3cfe9f8b88c22f464fe81ff3fa850d8a05396b6bac6a045fd55cf1790d0b42b7bfc98d565176f9099b5b820f57dde3a033fdba04886071f3272f6
-
Filesize
7KB
MD57f09d761641e012a457bcfa84fcdb6b8
SHA1d1bf9ae970525d300e4334d8eb8971ff921c72c3
SHA25680411264792a9330af1d6e1331b45b3168e389f39e254f5d04038342d7e1d053
SHA51205bbe6ded022f55dd01cfa1b0a9bb21f2b8550580d7b6057b936fe2298df2944dad14535715e9fa937de9bc5e928e3792fc43ffe6c6432edfe1d3eb45a942d84
-
Filesize
129KB
MD5941fd535b4d7c054234bb617061212ff
SHA1a64060d77199f7555920c561beead20994b2cbfc
SHA2560adf932647f0a888e6e2bdafb4dbfab3aa8f34cc38e682d9187039d48d27f13b
SHA512c9a02ee41d9a683b526386193c99dea8b3b3b4bdaea8de534a109c9dc27c836afcdf9eb8fa2b50ece93a027254bfbef2c1d84e3494942a5e7ede23ef6ed519a4