Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 04:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://e.usa-hydrogentech.com/hydrogentechnologyusalz//Preference.aspx?p1=MCQDU4MDE4MzJTMDcyMTo3NURCMzg0NzUyQUM2ODM5NDU2RDUzMThFNkMyNDU0NQ==-&p=1
Resource
win10v2004-20240611-en
General
-
Target
https://e.usa-hydrogentech.com/hydrogentechnologyusalz//Preference.aspx?p1=MCQDU4MDE4MzJTMDcyMTo3NURCMzg0NzUyQUM2ODM5NDU2RDUzMThFNkMyNDU0NQ==-&p=1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628143291421419" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 184 2820 chrome.exe 83 PID 2820 wrote to memory of 184 2820 chrome.exe 83 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 4996 2820 chrome.exe 84 PID 2820 wrote to memory of 2408 2820 chrome.exe 85 PID 2820 wrote to memory of 2408 2820 chrome.exe 85 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86 PID 2820 wrote to memory of 4832 2820 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://e.usa-hydrogentech.com/hydrogentechnologyusalz//Preference.aspx?p1=MCQDU4MDE4MzJTMDcyMTo3NURCMzg0NzUyQUM2ODM5NDU2RDUzMThFNkMyNDU0NQ==-&p=11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c58ab58,0x7fff8c58ab68,0x7fff8c58ab782⤵PID:184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:22⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:82⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:12⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:82⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:82⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53e92d09c6c2de44e78168b84e631c492
SHA10504b895a79e8c4a149fbb7bdba4a14fb5dc5431
SHA256da22bdd2041339f21e867f6e931d311ca48878614f359fb766767b321857ca64
SHA51297999f85af890ef28ddaf23f0ed2493bf029c55c5724ab87a4667112742cf99532d76fbbac232a3d86bd602c93bb4ab0638c949c2a6b266aa0c7250b3b85a97c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD52b817e264fd5705c71a51a3fe3abe161
SHA1af75beed0491343349732c09073dce6b637fc23e
SHA2566639a9985f851e4db97f0f83e50f10b592e26579a99893ed717d0d45aee0ba70
SHA512254908f1822ff1efc515a796e506f95ecb6b2f4da2ac85e07a8009546675371a1e306b513c0a29fa632ecec11bdc30ce1f13b9b1a1b24163d5f5d2afd20dc18f
-
Filesize
692B
MD5d313bcfa35c76e65405c962482e69c97
SHA105cbadae3eeebef147e96c96f7dcaac8b5edb048
SHA256bce9f166de64abe9ea9d574ad16d71bd19e91ee6113d3832a376e7d971e86bb2
SHA5124dc66f77fec17ef86b8ad44d15c7d1d02327b3f1604701a9b9ae120a779bc19daceb7796ff963c0e3588b4f638f98005434e59916ba26d04948d1e49f907be12
-
Filesize
7KB
MD5096ed20d8abd131d17bcfd7b6d4b2244
SHA19543c400591c0e24f1b1f7545073f841fab3079e
SHA256478770b7c9c680c86a167c2ae4c9660f2488dc84bdb470a80a44f74d4a1d727a
SHA51295eb17233f1c3e1a254c40ee9719679d4f0d2082ce79da5ee5cb62cf348a94192fd015a0a317f6b77570f4dccdc2ac1075e5a393b58d15aaf4976bc11afdb498
-
Filesize
7KB
MD5e17c4008576dde655017cd17462c3887
SHA10692254a194d745a37bf2c9c6979a00fc8c765bf
SHA256d3cc8106bbed8e677ad3dbb173afd2adf59d766e1f81b559f334e3b695525531
SHA512ebc99340ee13d3d0cafa9686b5e16b4bfefd71f1b40526e95931ecf775c2b22787f926f86fddd560b441e4e8f2649063d75f0c6d14ef56c43c0bb72d6833921c
-
Filesize
138KB
MD52d7789e58c4cd8054f4d9a1c38cb9738
SHA1bcd9b380478f3b7fd2e47e9613b15af7100623c2
SHA25672f83c5561b0af413f2c9bc3542ea82af1545116b12d08d2fcfbd30f3baf4306
SHA5123f9c536c7f08a1e2346303b49981d592e81c34f5971cc1a643891d4d38b214dc4464b65a02dad410bb912edf86298abc75fbfaa14285e8fc3617e8c0e5d885de