Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
53s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
11/09/2024, 22:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://147.182.130.98
Resource
win10-20240611-en
windows10-1703-x64
9 signatures
150 seconds
General
-
Target
https://147.182.130.98
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133705670892956882" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4476 chrome.exe 4476 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe Token: SeShutdownPrivilege 4476 chrome.exe Token: SeCreatePagefilePrivilege 4476 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe 4476 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 2772 4476 chrome.exe 71 PID 4476 wrote to memory of 2772 4476 chrome.exe 71 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 2188 4476 chrome.exe 73 PID 4476 wrote to memory of 3224 4476 chrome.exe 74 PID 4476 wrote to memory of 3224 4476 chrome.exe 74 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75 PID 4476 wrote to memory of 4648 4476 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://147.182.130.981⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa83d29758,0x7ffa83d29768,0x7ffa83d297782⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:22⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3256 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3260 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3256 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:82⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1848 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5164 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5244 --field-trial-handle=1856,i,4267613476535313509,16087766698698468908,131072 /prefetch:12⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204B
MD5dcd726c40058bd6b6cc7765dc2fddc69
SHA1257c05e599e99225ed9ec393cd0212ef81bf6e48
SHA256b1953ace7c5919608c54e99df7b3b9b0db9f8dcb2b6edf30ca675d610a25d68f
SHA5127eedc39657ee592626fb53a708d98bb7dee2a8933e33250f949d8f2f57559a02b9048b3366a86b9270af085bab0728be75058ed209d03f862c2ecc92c72c0e1c
-
Filesize
6KB
MD5285391788ee06e6932a9680fbe019706
SHA12153e1583d6ad7c423e3308724f9424b5368ea4d
SHA25629e9b4da155486efeb424456e373fbd4ae83c8652da82ea7a3cb5eaba62ae6f9
SHA5122f260a3836d8984f6fe29fd3b476c7c7e50882498dc7b35d34f8477852015a9e60e23a04ef8f40715649439af884cb335bbd6d31d28a2a47e91c70af66965bcc
-
Filesize
5KB
MD53a60198b66b91946d2b2979a8c134035
SHA17777a452b454e9c60a083d79baed961fe84c4309
SHA256d4d2ffc8e659e9af38c9bd2d9ea5313458986f11bad466f7728d3742f7803995
SHA512cb8e47ae32d5781db172ecd0a0b7d2a9df4530b313d69fd369754a1776c7cacbb89a19c967aad661616df151b3e241983d1d9ba196ffc51874916a01598ce232
-
Filesize
150KB
MD5b88778a564ac45363a3ae8ac0e7e471f
SHA18068fa1847b1934b2adba6139bd786929af1e819
SHA25682dd63e35d19d890da11eb5fbded67707f7a2d7440d6ca24fd5f0b3c3ce17259
SHA512f37fba2430724d28543f065e15f7c24f2709a7bd42025fd4ca8647131341b34c326da30bff1d7e14d46e4fa061068469fb011046b647fdabea6ce5fd807c8915
-
Filesize
150KB
MD59e961c1690781549528327c3c69427b5
SHA1bfcb0c9a843c7b9c2e3c144a44f8672cb6dda611
SHA2561b62250b6c3473233314d6807d49b8383a21c4a74fed369fe09baa15e5774ff7
SHA5127d5aafdaf71d6a5502494edfc304157b0d3fc3ea9ff5eb53c770ab35aaf8cedd7eff677097f997574e93219ab9d6793696586385cd749c32fcec367d2224c94e
-
Filesize
150KB
MD52f57bde48b5dee5878016145d0a931e2
SHA10d8f970f2132faf932fe226c10a2b5f2768b5451
SHA256e8156b43a071e9486c27df4784758a1a91dc624cdda751e7209cac378c011a07
SHA512b4b83da7d413ef8ac2c70328d544831fc613ebe3cad52285a470a7056a8e4d88ae072c0d31b3df9742197fde26bd7a97fd9b0c884fe00141a9de99bc4c86597e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd