Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 15:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www3.fpn-process.com
Resource
win10v2004-20240508-en
General
-
Target
http://www3.fpn-process.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619879303988599" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 5808 chrome.exe 5808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3968 2348 chrome.exe 91 PID 2348 wrote to memory of 3968 2348 chrome.exe 91 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 3224 2348 chrome.exe 92 PID 2348 wrote to memory of 2624 2348 chrome.exe 93 PID 2348 wrote to memory of 2624 2348 chrome.exe 93 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94 PID 2348 wrote to memory of 4768 2348 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www3.fpn-process.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccc05ab58,0x7ffccc05ab68,0x7ffccc05ab782⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:22⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:82⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:12⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:12⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3584 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5808
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:81⤵PID:5192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD538632c5ed16f03b96f2bf09a6a5c2cac
SHA16ce73e5ef88d5aa00a1c4c42ce0c1b9753004467
SHA25681858c679e9f204d513ca1f25a0c0a5c153ae5a09082df578cbc9901a832941f
SHA512192681af3f6f742276632fbec7b358ae25b78690d2f00101362fce446511bdc8955161ef1829ac10d99456303039cbae6d267abdf73d45963d09ce401c9dc9e1
-
Filesize
3KB
MD531d552de82fa881d4f645a8b932fd3f6
SHA1cc96da3f33c9424ae2937ec83b9e190f5299cff6
SHA256d71ca2bed98d9b767c42b9176375329e3298b01c55181b529793441ddfd26de7
SHA512cf4e5a664c6f1052fa70881fe736569578a5e78900a98360ca2e9e9fc63e7bf79c46f4463220727d972c4d4e3b9e51b2749abc530b3468928727a4daebe2ff7c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD568ab81bc4280e671815c0e4ab3c36a7e
SHA15d53208f8edb45a512701dbf4b823d9869288d7a
SHA256a938ae8a2c9a3cead87d01bea2ee6624cdc13397d736e5500f1126a0fabb567d
SHA5121b4b8cc2892536d6091b1f9f4bd5d771020e55c947525e0bed13d80173b05bedf31d4ad0a67001973a0a4721ea0a0815c903a81013cb91b449ce375da6d4c3ab
-
Filesize
7KB
MD5a667c2edbf7854ca47a0ccb4b09b3e5a
SHA16835d2668e4cf4f4b5011334ccf13ab8cd68f8bb
SHA25610b174d5bbfb102e501a011cd3cebd12ed07d8b10bd3f660fe6714ea153e0ba6
SHA5129266ab63622a6b7e8f2a672e2d7933ac1a1edac37f37be26753a4d81df39672217ffbe984eaccb31e4ba3469bd3e98944ee8b6e56374d38ae93c8e12d456fc69
-
Filesize
7KB
MD54bc7f55208e2a605fe05cb2f1a5e9919
SHA1da041a7dfc4772320e84833563e11a8bf5454a11
SHA25638cf4685c6e0cedd738ef8184f36478eafcd8133d7dfecf09cc78c41b413793c
SHA51295480fce75fca1d9d4abb7bd739d14aa5c154d3097d0534adf85350c970362fbed0b61214df0009977b3060ffefa46e82873f93cb4a608000f1561cee33081d0
-
Filesize
255KB
MD5f7f17d5e4c86f7e2f07f47dcc052a850
SHA1148b26ca8ea9f5a9386dd062bf7c33711608e89b
SHA256b87876dadced675db7b3c6042ab7a06aa1c321c5c0a5fa0583fd36b13c6bbdb7
SHA5127a97d18b882a7bf42b885abcc2f8ee787dea0383b3de66200a2c56eaf030ee2b3b07e80a2f3fcf9d0e1ff7436f9fcf62b4a59302523fb5039a490f8a7e4f2c1d