Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 20:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bc1q9w8rz7vwl70pqdf67rl.com/lnk/web.js
Resource
win10v2004-20240611-en
General
-
Target
https://bc1q9w8rz7vwl70pqdf67rl.com/lnk/web.js
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639933250338219" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 2968 chrome.exe 2968 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 1152 5092 chrome.exe 83 PID 5092 wrote to memory of 1152 5092 chrome.exe 83 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 1516 5092 chrome.exe 84 PID 5092 wrote to memory of 4020 5092 chrome.exe 85 PID 5092 wrote to memory of 4020 5092 chrome.exe 85 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86 PID 5092 wrote to memory of 2008 5092 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bc1q9w8rz7vwl70pqdf67rl.com/lnk/web.js1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8966cab58,0x7ff8966cab68,0x7ff8966cab782⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:22⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:82⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:82⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2800 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3292 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:82⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4492 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3292 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4940 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:4148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4876 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1604 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1852 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1900,i,11426001451354483915,2329961096516741968,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5283cbf097d93dcd941c4e4fe688fcbed
SHA1b6f0bdb49ee0b07290f1630f2bea04050e3c8404
SHA256685c799c8b685d50cddaf43427fecbc230a958588eda2de32f0bca0f6b34e09b
SHA512bc95dfc091181df0b6b2f83b5dd8d19c664177776760388358fb4a87cb75271260a14104ae9fae06d34e5ea97952846f62d1132868348945557451fb44b0eeed
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5b37fdba593a23987f56aa03422e43535
SHA1b619863c0b47db1b6d0f0d3daa525bf3e600ee48
SHA25666fa6e95fd4827ac122a485c5ce8c493b084aa7ecd590cfdac879f255f9606bf
SHA512e735d4b22056f8ad555b2270ba573a999f500249b4dafa5084db7ea9033bd10c0a13cde478dff7648b59b857a9ef897f8c601d90c5cf78c692e6846e81d1b866
-
Filesize
138KB
MD58c42fb353b1f5c06d3525f598dcb4377
SHA1c1084e46301cb017f99b9d794a5ce7a69539bde0
SHA2567dee18fee888773d160437328ff6c360099382dffb19170765e3e03744afd58f
SHA512a12f1fff20018948f11af74c49548e6d1cca2c8e1b046c38dc360fb180ee5ca3c1831283899975605e5ac932753ea34fe0da1ac19e23a950196e2019834d2454