Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 06:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://notifications.miro.com
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
60 seconds
General
-
Target
http://notifications.miro.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133661043878079915" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 920 chrome.exe 920 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe Token: SeShutdownPrivilege 920 chrome.exe Token: SeCreatePagefilePrivilege 920 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe 920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 920 wrote to memory of 3200 920 chrome.exe 84 PID 920 wrote to memory of 3200 920 chrome.exe 84 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 4272 920 chrome.exe 85 PID 920 wrote to memory of 2900 920 chrome.exe 86 PID 920 wrote to memory of 2900 920 chrome.exe 86 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87 PID 920 wrote to memory of 2240 920 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://notifications.miro.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcc634cc40,0x7ffcc634cc4c,0x7ffcc634cc582⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1844,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2004 /prefetch:32⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2396 /prefetch:82⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3080 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4036,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4648 /prefetch:82⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4796,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3292,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3832,i,2188825829140495314,2965284313739115797,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD501be70f308ce78a5eb22dadb70a89c2e
SHA18c36ad9b130f83df556f0161e955541ae2169164
SHA256e3735fda44bd8f06bb9209c24a3edba176767f7a248de1c9a28cad0f8a2fe3c8
SHA512f996b3f881f88763277aee8c67c3bc6bf121d4337dab15df4bd2877ee24658ac5042460f6f44220ac4267227221385bddb9ce5cad80e9c9e0d94a48826828d41
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD508142102a990af61792afa4545ed4780
SHA18cbfb45a0f88c129e275efb002c40187a43bb303
SHA25630813d00506a8c60158d48cab95474346f4cfdc9297d635ef47aed5626df407b
SHA512663a233a780c865ff75e278e7abe98f0a15bfa884a61b58c27cd479dbae0c53bb38396061fc930b8b773e7d4de1a8e574176db6a47dcb05a2458d54d86b468e1
-
Filesize
9KB
MD598a946ee5a0c7f60983b27629d010de8
SHA19e9ffbfded32ef4fe031e1bd1dd9f9ebdee338ad
SHA2565e27e6a5aead5b81b8fc158fd7e827727a948faf0214c2ad7c29b68fde417a32
SHA51290a8708c95887e11f7ed4368551951153beb1cb732a821880bd39abd46d4ffd847f5c4406cb82efc91cd64c0e91ad4e870c5d4cd9ac05c8111b8e958f98469a8
-
Filesize
9KB
MD528fd07bc54c0d6a39cde57de98cb509d
SHA15a7453886b2792fe3644bf4cee07f01898ae6b48
SHA2561e79cd619b991a232368ed96d9ca4cd673317890010bc2e3a974117b682ea71f
SHA5126d03f531bf982fe5f549ee07e9c5ee3ff124648dd32d2bd02b8bdae05248f34af8a2dad4d90709cf9ff5eedda5fe922ba15ed83db08f366abd32d820ea01345d
-
Filesize
9KB
MD5cacb244a96ca7293c5bc34445827797e
SHA1a9b4dac3fac3949e72294d8c54fc5b40300131b2
SHA256e805f185b87568cabddedfa031c10b36a4899dc142d77231eb2990c45e220a4d
SHA5124b72ff8d035b9bb2b775bbde4cad2db254bd8e967ccd3cb8e1c8e738130b00013c14e25b832b8e11fe760a1aff9779f5ce70b9307718e8b277cb63db9825d4dd
-
Filesize
92KB
MD51cc152c331d1eb586187b3af7e4aa0fb
SHA17ad983c68e73448ad53e9b9027dbb2140090d653
SHA256abfadedb701ff5d7f9f5112013b1d9e938e806ceabd065a76b94c588d351fc84
SHA512cb13dc2af500c123e0bd01acbce13b5e068f417599b10b067704eb14e61a21d88de659ec7bfc4d2f223ff7699f1fbcf8eed8fed2fd4a28f6da43a9a9dac640ae
-
Filesize
92KB
MD5141fd24df45e8c0fa90fa9bd0eaf1f45
SHA1637b3becbf9bc9caa79d47911953e07be58cdb99
SHA256a7b7a06b684f1141434f2f6490c21f22e9aa28e91c571de829e3b6a6f997969d
SHA512981d991e98d8f56157da00a84ba862faaf3c0bacee814dead69616666aa9eb9342a558e201df919cba2c631a6e81fc95b8554810f6cde699a49ab7456a79a739