Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
Doc0688600-LA0015362-2024.htm
Resource
win10v2004-20240508-en
General
-
Target
Doc0688600-LA0015362-2024.htm
-
Size
6KB
-
MD5
db630920f98d93e1168c420cb3e3ac31
-
SHA1
08800096ac08e3d042e957d88a1b1b1dc79dfa52
-
SHA256
9d65097c392261aaaa1148dd5a65182c8b11d17ffc3578056da5ac606bf0f3d1
-
SHA512
1c70cd680c6c6d957981810e7f376b5779580457abec55d6690321aabdb5a26907c19d03c9e652bac8004eae87c1669e2e831278b5b7b90f5f1b4559b69f9250
-
SSDEEP
192:6sft9/hWneXXINRIXkNRh6m1sfGLQiRZMyAEa:68Dh+eMd58D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621635723850528" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3668 chrome.exe 3668 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3464 chrome.exe 3464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe Token: SeShutdownPrivilege 3464 chrome.exe Token: SeCreatePagefilePrivilege 3464 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe 3464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 5028 3464 chrome.exe 82 PID 3464 wrote to memory of 5028 3464 chrome.exe 82 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 3132 3464 chrome.exe 83 PID 3464 wrote to memory of 4344 3464 chrome.exe 84 PID 3464 wrote to memory of 4344 3464 chrome.exe 84 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85 PID 3464 wrote to memory of 4720 3464 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Doc0688600-LA0015362-2024.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffc4d68ab58,0x7ffc4d68ab68,0x7ffc4d68ab782⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:22⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:12⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:82⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4632 --field-trial-handle=1936,i,16086967246111255799,15406077034883733283,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56bccc657b8861d94cd30539eb0d5f6bb
SHA1adfbadf7977fd30b72c8abbe4b3b1e5f713d8f61
SHA2564973dceaab924f4c8bad12e9b847849cbabe0efa156069acc7834092e363c8b2
SHA512b919d44a1e89f4f67526487694ee103ff05eb1df25bbaece9124b1a8c1f4851851d5bd1578c0f3e93d5850d363b4c4d3bbf18ad434cb8ac2e693f809b286374c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5b67b7d82e49725c96465931b6dbc16af
SHA159af46e578ab75231778df2038b7ac4c9c539222
SHA2565c905ee6a6d37c18e78a02c790304b88355552f7fa1f2eddab41a1392d1fb000
SHA512a003b25e07b53662a068623c171cdc77cf795775b1b91e496c998d11ce551a7b2600136f3f7dff710258e3e0912aa77ad5cc6bd68add3b5b2ca5958338219344
-
Filesize
257KB
MD58f512919dc1050e3dd4eb61808ce110b
SHA196c5170103e9b5910dd490e0e2fce2e3bfa71fb9
SHA256e0495cfddace30d80815aae4fb4eaed7f03995288f5529eace447e55066512c0
SHA5123989029d2e6e4c708ba5a20d5460a79c6651e2600d93a36910a0f71c5d84492a68f4e54cceaa5f03da26eb08854a8db9ed33771060586a27016f33b81cdd56a4
-
Filesize
257KB
MD5fe09c933e7f486e78a47c89b843f6b51
SHA130aac0d521291816b84a80b9dc04cf48ea343073
SHA25667f897309e59ba70ca36140aef6ac00b0dda7165de8f5690fa1d725cbe175246
SHA512775fd904b8abe6aac0ae5cab7dbb29b69fbc032cb482e44d9386307cb31d47399e450a76aac94e229161518202ca18e18f509b3311311951940217b77b11af09
-
Filesize
257KB
MD564f5369e75a39e2eaca7570edb93b119
SHA156f392e2e2649c3ba0eec975d8ec6cfda3bf07a3
SHA25651c926ba2afea24fa5a2e3b38b338b695cb67964ea658b2ac35deb3233a3a4b5
SHA5124460d5ad219231577b5bf59e87a2386ddc9c4769f3a3bd8c4c9a75b65984add11b57db21f9fd7ea8471f1d5efd708fbd39ebe100d72b6c6ecc30a939ea43e846
-
Filesize
277KB
MD5f9966671fc33160c8de3f0837fd809d8
SHA16de424c4eb8dcc441271cfe213f588be9621eef6
SHA25671948e0d03a21f15f1d6839f4eb56290867dc7c9758cb250ee42c7db8cc2e91a
SHA51232e92d820e228ca9ab64f9aa540c096a4ceba1fd4619139df3da1437b0be5387903413e50b7675359a9dbdf292eb8c52b88512600dc7dc0489cfd564ad55c502
-
Filesize
91KB
MD5e4609ba5b46328d264d39910cacd3185
SHA1a7824d344561b00a786140ab01bf4bd9bddffc8d
SHA2569f69efe97046a881deb36fd52ff1f41cc83ba4a8ac085419ac1bab43db567984
SHA5127ce8f87d167bc0b44eda38dcaddec7292b008e46153c50e7cbe50849f65861ec06471258622e4990c358d7cca02781333edc412997da6777ef91ba19ba2da44e
-
Filesize
88KB
MD500550e98958ad0c8cbb44d0581056c17
SHA1ac92e9f0d4216b6a22094afeac09b7391584575e
SHA256e0e47c07afe95b573dcba244c1d3ed5ba12325e71e761992ddecb8e4eb7fdb82
SHA512532e0ba3537fe71d400fc785f5e66743bebc697fc5418da660b3a91753d272f43cee7395cf2280bdf42e33a332b034d15e472d16784caace9bf7fdc7a5f52572