Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 21:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://econfigure.abb.com/conga/c291cmNlJTNEYXBwbGljYXRpb24tY29uZmlndXJhdG9yJTI2bSUzRGVkaXQ=
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://econfigure.abb.com/conga/c291cmNlJTNEYXBwbGljYXRpb24tY29uZmlndXJhdG9yJTI2bSUzRGVkaXQ=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621837238417825" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4900 chrome.exe 4900 chrome.exe 2488 chrome.exe 2488 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4900 chrome.exe 4900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe Token: SeShutdownPrivilege 4900 chrome.exe Token: SeCreatePagefilePrivilege 4900 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe 4900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2068 4900 chrome.exe 82 PID 4900 wrote to memory of 2068 4900 chrome.exe 82 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 3972 4900 chrome.exe 83 PID 4900 wrote to memory of 2620 4900 chrome.exe 84 PID 4900 wrote to memory of 2620 4900 chrome.exe 84 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85 PID 4900 wrote to memory of 4892 4900 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://econfigure.abb.com/conga/c291cmNlJTNEYXBwbGljYXRpb24tY29uZmlndXJhdG9yJTI2bSUzRGVkaXQ=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe4014ab58,0x7ffe4014ab68,0x7ffe4014ab782⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:22⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:82⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2272 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:12⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:12⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:82⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:82⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=976 --field-trial-handle=1928,i,9940714589453809520,8371725727036069111,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d1764f3163faa0cd5897f6e8a4c846b9
SHA19d2dd445012566540adbdaa8726293f3a20b752d
SHA25688a0bfb735533bd98523db6d5ad9c9a3f061dbef55177798617348e6dbb55ba4
SHA5123f1c6fe18646eaed8d4d52d22d132e4dbce0660f9538e90c3a291cacbb08b6b33de4acc526d25c4745ae1dd10d65ef4eea35af9853f479bc6cb931113a7a7286
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD56ac4ec96d04f1758c14e209186723a33
SHA1ad53c00277ea107ef5b39bda9ca99ed413d01f1f
SHA256d608b7b564ec18011316a649d0c8e9bb289586b1207f7178a0f58131da5c938e
SHA5122915bac906ef7ab1f5492696663b30f2bea11eaa1816c52a81b2d497e8c8cea56627b6720686897dea3c3f618a446ebfc93db89c967f806a07b8f2b485854392
-
Filesize
7KB
MD5fb890ab679576d3e0a7b26b72537817c
SHA1353faf5d72fefcd533c7a4354144bf60bb871aac
SHA2567b6bc1604e7ce0bee597dadd37011b460ee5b6afd2e9847c325322b2c4036dde
SHA512112f96f38117aa7518f318c0264d10ade12138c99a95701765943564ae0b02442797f94908a30ed1ea5bd35472a5dc8b5661fdc72a3427163fd997b88ac908e4
-
Filesize
255KB
MD59d2f09ffbd61d20da323635ad6d1ab2a
SHA10be50ec03f7cac6e3cbfc4b6dbe76b71f49097e5
SHA2565593c430b02f382cc8f6c1d1efc25e167e2e653a465ee1859b70f1db463c2858
SHA5129e25a873e3d2f18061ea142418f67eb76e321e5a6d06854dc50d100710657336a027c7d5cea205d6003078474fcdfe355d6057bba8f0eb8c7fec7991fa77aa7c