Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 05:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://peakpx.com
Resource
win10v2004-20240426-en
General
-
Target
http://peakpx.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618658794640333" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1412 chrome.exe 1412 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe Token: SeShutdownPrivilege 1412 chrome.exe Token: SeCreatePagefilePrivilege 1412 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe 1412 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4356 1412 chrome.exe 82 PID 1412 wrote to memory of 4356 1412 chrome.exe 82 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4212 1412 chrome.exe 86 PID 1412 wrote to memory of 4728 1412 chrome.exe 87 PID 1412 wrote to memory of 4728 1412 chrome.exe 87 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88 PID 1412 wrote to memory of 864 1412 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://peakpx.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4f8ab58,0x7ff9a4f8ab68,0x7ff9a4f8ab782⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:22⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:82⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1744 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:82⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3512 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:5332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:82⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4604 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4124 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2532 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4932 --field-trial-handle=1828,i,12691650855627829358,1228948657224408898,131072 /prefetch:12⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD54f27d03b9c9858ebd6a9680ebb28d483
SHA1a735b18859be00748fd0d15cd189e98e9a270ba6
SHA256155c209608bcdda4a4bc1628d16df4509dd319ece2818aaf4bc4eafcb1ee7a07
SHA512f0456258a599b1b0ab02fd157d989ec284f6ebcc1b9624647b648edf39874e4c9adf100ae037b731068d691e91d1ee6242cda96027fc714708505dfde82b3d6d
-
Filesize
92KB
MD5e0d0524fbf21a49eec1012df3b4ad9c4
SHA158cfda182344b951cec7749dafcf4dccd0b008a0
SHA2562c928a0e1f75d3cada727fa6386942ca1c56aea2456e3d76024583cde30058f8
SHA5129ec3e43922dc1df27f2b131ad1611e63edab38a68a0edf6a578c373c32ed044315090dc0c1ee7e7f180dff96388847326d3486e212da1248352a448b71bfdfbb
-
Filesize
168B
MD5cb268bc801607f4e7ce0015d01227872
SHA15fd87de7444b37eb799e74698dff705e63b819ee
SHA2564a34f1c3625cdc572b157a1065a697beebff34d81f6a5fdedddb410c812681a3
SHA512da711543b5c916651674efb5f867e7d03125e3ccc0dcd68c8ef505e0c74e86fef8a0621f8b89e40e8a725366ab7f4f1601804d4ce10f8e203e5aed6deba53d07
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD5b859ee8d7259c15b3e0f39a756a15b7e
SHA15e88e1081dc2df17f334ce75fc70f19209a484de
SHA256627004df444072a6d8421e48556086beb2106055a7fce2af6916e69cc304d622
SHA512a6856e45e0d851a607c85da3cb4da608ed9070786e2aaf21d84ea2e6ad74c0068873fd14a4df52a10b4adb8320cd130e7f7c3db93d0e91bb93c2b40066c80fc4
-
Filesize
7KB
MD5daaa274b615723d5abf1201467c0bedc
SHA1a364e3c619e5821e4ae5b196b43dca9a4531e114
SHA256a448449c50fbaf3bbc537adc05dd8950fc47f866408268609dd93001a9376f5a
SHA5123500161a7a846b3de28fc7c5c32abc16b70d15c11063e845c393f36c80803a8036a773f2151953181b7c425fc143c856057b1118b41dee9d0d291b52b6cc48be
-
Filesize
7KB
MD536590f622008c99d554ebb0185a10167
SHA14a5cad1f56d541c7019e5a6869ff954c96791052
SHA256851a10e6ff8343bed683dfdabe54beca35d42b525c9a30dfe07172a3ed1e7f29
SHA5128c445682f43909fb7c35b7a655fcb5c238b50b2bc22ac82353db1849cb840de1bd3c48bf8141db9c44b0cd442b16176ea2754df742a70966b4c52e5efa27a377
-
Filesize
130KB
MD513f3efc2af95c0a77e5844793a5606e8
SHA165293b264b279816c9851285a1973f0cd353ff19
SHA256696ff407e6c04a85a71e45e1066f039c18c257a9cff8d4f791f4ddc1a5d87226
SHA5122029edb6821d0ead25318ed7c304dda95e317584e0815021fd6ee02b8b70d0e0441ce8fc3ad23b226026ba63b5a5bb57ff7283a1b7eff7ba078bfe3aee7b59d8
-
Filesize
130KB
MD527f6381835d1dfd1b11d87ed626f302b
SHA19f126b156709cd333dbd791ad1533f6bba1f86b1
SHA256c74edb9614f49bc88f79952905c6d18e4ec95d50b54add35e769d0cf9e1d9cce
SHA51271942684e0e6d0a17d05e458c90f9dc61c7c49439edc6695490d25e69cd406e79c0f22bc9b33669597442f8bae71c579a117ba123584265b86bcd16e66b3af18