Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
43s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01/07/2024, 13:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fa-ewuf-saasfaprod1.fa.ocs.oraclecloud.com/fndSetup/faces/deeplink?objType=PROVIDE_FEEDBACK&objKey=pFeedbackReqId%3D300000667783822
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://fa-ewuf-saasfaprod1.fa.ocs.oraclecloud.com/fndSetup/faces/deeplink?objType=PROVIDE_FEEDBACK&objKey=pFeedbackReqId%3D300000667783822
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
3 signatures
150 seconds
General
-
Target
https://fa-ewuf-saasfaprod1.fa.ocs.oraclecloud.com/fndSetup/faces/deeplink?objType=PROVIDE_FEEDBACK&objKey=pFeedbackReqId%3D300000667783822
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643154415104619" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3368 chrome.exe 3368 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3368 chrome.exe 3368 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe Token: SeShutdownPrivilege 3368 chrome.exe Token: SeCreatePagefilePrivilege 3368 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe 3368 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3368 wrote to memory of 2356 3368 chrome.exe 73 PID 3368 wrote to memory of 2356 3368 chrome.exe 73 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 2004 3368 chrome.exe 75 PID 3368 wrote to memory of 4764 3368 chrome.exe 76 PID 3368 wrote to memory of 4764 3368 chrome.exe 76 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77 PID 3368 wrote to memory of 4860 3368 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fa-ewuf-saasfaprod1.fa.ocs.oraclecloud.com/fndSetup/faces/deeplink?objType=PROVIDE_FEEDBACK&objKey=pFeedbackReqId%3D3000006677838221⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff965119758,0x7ff965119768,0x7ff9651197782⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:22⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:82⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:82⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:12⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:12⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:82⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1832,i,428055501220052141,12761080181706962700,131072 /prefetch:82⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD58047c965bce7f9c3c9e84cd192bb2a72
SHA12bee581588c13a0bfee2b7fa4f16e8e8041f3723
SHA2569472c935a7cbaf7b21e817d2ea708f7abe12725d65f7e6e511f388e4d463fc5d
SHA512d13c96ce14c41fff525018fd4e94d2c84ea7e09284ffe6823ff7ea1fc6747aec6cb47d15faaaecd0faba5408ba7b96d89d959abeb91c44cf4e2dae2ff534281d
-
Filesize
1018B
MD548191a2a6ed60f19a71da38d8e2ff672
SHA1cc30b5dc0637440f211b3ebfa371879d1d8f4168
SHA25661db930c09c77a8ae0d97b7e137c9a5a25561c797178feaff786b69b2b599513
SHA512d87ebfb6ee9c775fb1cbca7afb16647506034cb9100df504f180f36fe69135de7f4aad5868a72e25b9782b3fd63b41a4514e58d82a5b3171f095ec53267097a5
-
Filesize
703B
MD5e4b0952ecafcf9b523836f6a3a2ce461
SHA1f9215a564f9244a74bddc047af0e6ecaa7d2a469
SHA2565c22916c24f576bb1bf350ce94a37933310fcdd5dc8c606f13b11359798c26ba
SHA512c5ad789e2a71ffa36e521025d99c795b5acb22a2b24a3fffda370f02d731e9b6135e41f3bfe54020d2c734a3f1aeee29982c08008c12ae79e8f3b62987d22ab6
-
Filesize
6KB
MD512777d6cbefbe5854a0de6ff8b36331f
SHA1ad8128081e0c6b4dc35dfffcb66bebb7b5fa01c2
SHA25660850553f107311a6b5165949324014c6d08052c0d07c9850e087a2e2c93e8bf
SHA5122c37f13f9c2e69376be3df5c6e7b1a6d73c5586bcaab2b060600407bb617c8a7dc31f37f18f69dde8c0c6a3456732fdb29a78d1a475e18d993caf8227b9fbe36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d98b114b-c9bb-4de0-b721-ba32bca80d90.tmp
Filesize6KB
MD5cc0128e19823100a5bc392e76f6ccfc1
SHA1f434b82f81d93a3cc968e3f5b9d864a19210b8eb
SHA256d07c8ec9ec7eb8da2a5cd4a4ef3d02dbe548f30fdfdeacf07a36e48230953f6c
SHA51220c38dd023a5f2773d93d37f6fad41e90cac4b4af5f8cb2da197ad9f015e9e7bd7736a9ce768aa9bed3280b8558ed082ccaf52d75a6f0980f6a9cedd9b66aef5
-
Filesize
136KB
MD5d26c62a18ddae295a157964491eee399
SHA1ecc9c2509b34dd4f9682a7f678cfd7049ac8d509
SHA2561cf4210363f3372e9499399a696d4dec304078b321c5204e1d20a07449258041
SHA512571b2c0a460ccba4d00d96a177fd028147ae84339db6e28ee51ed569ad744184d2cebbaab73ca54600a10aac2d116429af3c04d6e1330de5c03afe60642fa48f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd