Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03/07/2024, 16:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/JIizmL
Resource
win10-20240404-en
General
-
Target
https://gofile.io/d/JIizmL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645000507629832" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 4576 chrome.exe 4576 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe Token: SeShutdownPrivilege 2820 chrome.exe Token: SeCreatePagefilePrivilege 2820 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 1860 2820 chrome.exe 74 PID 2820 wrote to memory of 1860 2820 chrome.exe 74 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 5088 2820 chrome.exe 76 PID 2820 wrote to memory of 2648 2820 chrome.exe 77 PID 2820 wrote to memory of 2648 2820 chrome.exe 77 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78 PID 2820 wrote to memory of 788 2820 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/JIizmL1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd62259758,0x7ffd62259768,0x7ffd622597782⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:22⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:82⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:12⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4368 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:82⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD57280a9bf376500123593981766b51336
SHA170441bdd2c901b247f43a71b5eb0c229b5a1623d
SHA256fef7f4a354de68c90c7f225e5f9f3712d03eb2708b65fb96baf99b6b45281bec
SHA51238fc418c93bbc8ac9ea38f22074e969f6aa570fb90fc54ad29b7618ec87c2df790eb01cddb213c5d56f40ad0bea80f205c90c2afeb7d841797b063e3049e9a8b
-
Filesize
1KB
MD5b78f0e66f65efe7fe38c1660075d3381
SHA1d6b073da60d355873d58fc7ebcad46f67379f8e3
SHA25616b0dc7db2e63e2792ba940c1b1a1809e85c891543762ae4763d97ecc377c23b
SHA5123afe37471d3a4318b021942270cabed89c7c7594322b8a5c07e1f359059406cba87a1580b0dbbe4237920f01ab2a66ad2e6fd0a0a019a9d7ca54414387745190
-
Filesize
873B
MD5671b92b073f266558bb8c2a9ffc70e26
SHA14b30c8d733a03ebe8aa5371e766dff55f5cb0a2b
SHA256ebc2b14b51c9920ffab6f42aa2912ecc5e4a215b771a50a9b64b38942e9adbb5
SHA5122ed278defbda183731e5c69d3238c1f029a7a5c8d8694cd2d832280cf9ad18becd3686e6065f0da6db32251c85c4414f6aa9a0aba8e8d11bb4cddbbe0b2088c3
-
Filesize
6KB
MD50ff8f2646b83f8790c64c6bdb5e0f080
SHA142f4e28cb5ec03cb5503c7095990d72c89c2fda8
SHA2563f6edece02bc5a49338bc71fef373473f4d20cd120e1a7b460b4754a7b6bdb64
SHA51233c27831be2b4e9c8f66044a204421d60237fa2322f352441756df7b1b99f72fb8e43eefdb5517b3c5aa8c4cc377e88ef9a024040a436fc042800b61f24d917e
-
Filesize
6KB
MD5bf7ab549ba9356142de6be77e456044f
SHA17638ff1a9ac12d06f6d6b968b234dd43e526fc9a
SHA25645d617e3c774ea22a8e09457b83c2e90236f25258ec0de3bd6d540b41d7b7536
SHA5121fa794a6a76a3bc1e21db9229b5631750968268f9b359806b57756cee53e3345fe5c728749e73e44e777d1963b93214726ec419b0c46143db34e5bba914358e4
-
Filesize
6KB
MD5cd395efa5d3b1aece0b785992e71446b
SHA19c5c423fe601632f8626c0b0b66d4f41012e89c6
SHA256f1fb51029cf600ff17039e82507ff568cf613cde28b909bdb50e21ef2e167aa6
SHA512624423f03d6facacc109e2bcccb7fd9e60b61528832a6dac38506d15a649ca3074e1675fb347dcc58d6eb7e00292647e93ce6a359762aaa1e379537a8d901cd7
-
Filesize
136KB
MD55ea76e7de2819d0ea45878e5728ac79b
SHA11c3f09983249c6b46305f31f0705d6db2b943e1a
SHA2563e674d36632c7a41f8bd1bd826655229dcc65a1998bb12d6cc9f434c29df6905
SHA512233baf5733fe7c65fec8a512454da15cff01d40339266fec1407c900b6ca1509803d65a611b369e249657f9d84db7e074576ced5706a3300d356c12705bbc52c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd