Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/07/2024, 06:12
240705-gychwatekm 105/07/2024, 06:01
240705-gqxtvatdpl 605/07/2024, 05:55
240705-gmv6vawdrf 1Analysis
-
max time kernel
600s -
max time network
605s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-es -
resource tags
arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
05/07/2024, 06:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/pAXkdm
Resource
win7-20240221-es
Behavioral task
behavioral2
Sample
https://gofile.io/d/pAXkdm
Resource
win10v2004-20240704-es
General
-
Target
https://gofile.io/d/pAXkdm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 4288 chrome.exe 4288 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 3384 2756 chrome.exe 87 PID 2756 wrote to memory of 3384 2756 chrome.exe 87 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 3560 2756 chrome.exe 91 PID 2756 wrote to memory of 1172 2756 chrome.exe 92 PID 2756 wrote to memory of 1172 2756 chrome.exe 92 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93 PID 2756 wrote to memory of 3000 2756 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/pAXkdm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5fdbab58,0x7ffc5fdbab68,0x7ffc5fdbab782⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:22⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:82⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:82⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:12⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:12⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3544 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:12⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4624 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:12⤵PID:872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1924,i,3439652237606446703,2557370362870108882,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,16691795167284021271,14811050493481776435,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:81⤵PID:1908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --field-trial-handle=5052,i,16691795167284021271,14811050493481776435,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:81⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD5c1f9b648c24e7c0e180a577e5eb2244d
SHA16d40d42090723b83c51829cbb9a296d5a949e737
SHA256eb8506c5b930af07b81b521f673bca1cef72b1c13d9fa42705fbbb055b9140fc
SHA51252b3ccc6acdf5b3ac4ef1e3439c6287c780f8a48464e3d6ffc6a7d9a8f1869ab8f3bf3bdd5dcf2b421f37b34380562ef1e054767037b7bfe2215497f8d2c6390
-
Filesize
2KB
MD59341081330d322ab90c111123d873416
SHA17feb249ba7056317d1571504a5ecb64010c8fe0f
SHA256470299646a6d0b66f84ddd08a46a5713eec86c6e07da174e917ce4fbcd294a2f
SHA512d8b893e3236a94898bd402289c664a08eb43b129995ed55ca0ba1186366d052d585f1566e8849e8ff872a57f823d7c49f75bbbecc5d5c7d7e4e7d126a266ddc7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
850B
MD546cd24298bc672df151819ced5042dee
SHA13b2f88675212a8182ae4a21cc06d9483a12109da
SHA256c41993da832cfac34ce6bac633de0829350ac65a4fccef4d12a6bcdfab29c317
SHA51289d5cc45db12c9bac1c77dac7825e9773207a876411a78dc8a2eb9ac4bb8da890c66d0d01eff11dd8f5d36ffdf6a3d9f48eceaded9c4094ba1e77753427a43be
-
Filesize
6KB
MD5dceed2bc38312ea091c103220913bd68
SHA1489baa5b420f430179e854feb6afcaf9b0cf4145
SHA25691371ebd9a45d33e0bd6ceaadcfe4c911da462dd7573263d35ccec76c02b0344
SHA512cfb89825e44ccfd0606bea88d184373849512e41ff117585a093b841c66169ae96519dc9ff6e1c55ac4e7d80599b74ca58053b5d9be8ae9dd888f8b1b8b52d3d
-
Filesize
144KB
MD5ebf62debbfab71379f2ee58ffa00656d
SHA1cf50d01c575361c134f4134f9ea80de3d0be169a
SHA2560827f30cdaaaa69cbd27c293864d95dd3ad3917e4f884cfe93df6493ac90712b
SHA5125b4faa2eab21f8793d1c5daa5bfaf38cc1941fa66bea2fa5f1cceb6a17a50c0b4c2df1684ea3b3670daacc01e4eb46019ff559ee0d00da2a03d62847e8dfa2f6