Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 12:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://confluenceatl.saicwebhost.net
Resource
win10v2004-20240611-en
General
-
Target
http://confluenceatl.saicwebhost.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627543076571821" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4752 chrome.exe 4752 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe Token: SeShutdownPrivilege 4752 chrome.exe Token: SeCreatePagefilePrivilege 4752 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe 4752 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4532 4752 chrome.exe 81 PID 4752 wrote to memory of 4532 4752 chrome.exe 81 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 2116 4752 chrome.exe 84 PID 4752 wrote to memory of 696 4752 chrome.exe 85 PID 4752 wrote to memory of 696 4752 chrome.exe 85 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86 PID 4752 wrote to memory of 4656 4752 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://confluenceatl.saicwebhost.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bef5ab58,0x7ff8bef5ab68,0x7ff8bef5ab782⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:22⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:82⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:12⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3948 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:12⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1916,i,2624759515338938417,6200054913853231834,131072 /prefetch:82⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD5c46f568aa3ed603bd70dc29bac2be700
SHA1c36ce6584731be2052a05e35af518bf2818fdb55
SHA25681b7dcca30796f779f120fc887812de8fd48294f1ef6bada418e1c67dcb629ad
SHA512ba71f7419a1a1ee14f25e724f9f11e659a71281518c487b7ec066a601865f765f6eacafc3f2c75f48b6846ea209ccfa776980b0f22753806222ac528ea397d6b
-
Filesize
7KB
MD5fa9baf37a19399df79eef065ec845110
SHA158adbf118af47242eacc68fa39e7904063118243
SHA2569c94ff60db267aa103351a1151341975c9d5223ccda26aeb156eb9df603b9763
SHA5123d4113e35631382d7e3d13489dec7e4423b7f0b98c496829f248df9c808628cb1ed8494b56f9698eab3590a838116749f2a7579d19f1984dff6bf18b72e3b908
-
Filesize
138KB
MD56a94fc797366826997eb31bff430d790
SHA17972a1a2c46695d51707a93e1dc18e1a38bdbbeb
SHA25662ad48fce279943fb4594a6ab74e9a5c09f43097cbe467f84b7a2dd2f9bf084d
SHA5123cfa031e6b3fe562ff37ffa7e73c66f65d827b39ce23fa9655560db373d55776c2110a719518fc792dd52637ed5a49191de3b1c02007149d2de37768f672db19