Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 04:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://wpad/wpad.dat
Resource
win10v2004-20240508-en
General
-
Target
http://wpad/wpad.dat
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636775157142439" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4216 chrome.exe 4216 chrome.exe 3496 chrome.exe 3496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe Token: SeShutdownPrivilege 4216 chrome.exe Token: SeCreatePagefilePrivilege 4216 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe 4216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 416 4216 chrome.exe 81 PID 4216 wrote to memory of 416 4216 chrome.exe 81 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1748 4216 chrome.exe 82 PID 4216 wrote to memory of 1112 4216 chrome.exe 83 PID 4216 wrote to memory of 1112 4216 chrome.exe 83 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84 PID 4216 wrote to memory of 3308 4216 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wpad/wpad.dat1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1790ab58,0x7ffd1790ab68,0x7ffd1790ab782⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:22⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:82⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4112 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3184 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:82⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4668 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1876 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4560 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:12⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3876 --field-trial-handle=1920,i,12107545883449774096,10034861954640941399,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD50363e6cec02ad3db88d4c44b230e97ae
SHA15ae669176f0bc6ace956c8245d3b03f2e71b6bb4
SHA256b648d8514a1d40ebd16997f97ff32deeb3b0b6e35b37760cb2ecf59ddbe1b38e
SHA51246cce55399389dc83de691aef86133e52f764ae2d215493ceda8c9041963ef03bb8f4bea13f809c84596f19b389b4885b3b1442e2cbe190c3ddafc626076970a
-
Filesize
129KB
MD5144a8d9f6f3836240b52d7fb5012e512
SHA1aff862e4eadf7f70a0900cc9f8a0781c0a2bd2ef
SHA25600b4663682d48eb834f3c5d1a850e7d29e6f9b29209b05b7ec7062131774c986
SHA512d4eb0e4bd56a2e9a85d33dedfedd1d6f8c2079666d2e6ed4980b9bf08d41a77d0ac9ec57f74a6e6fd37d699694aa726709b3fcf063a458d7256695e9917efc6a