Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 21:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nucast.tv
Resource
win10v2004-20240802-en
General
-
Target
http://nucast.tv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133705630023445556" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2360 2816 chrome.exe 83 PID 2816 wrote to memory of 2360 2816 chrome.exe 83 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 4984 2816 chrome.exe 84 PID 2816 wrote to memory of 2196 2816 chrome.exe 85 PID 2816 wrote to memory of 2196 2816 chrome.exe 85 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86 PID 2816 wrote to memory of 2200 2816 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nucast.tv1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff449acc40,0x7fff449acc4c,0x7fff449acc582⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2156 /prefetch:32⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3040 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3024,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4428,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,8737717984442023969,6152729346709088008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4828 /prefetch:82⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:60
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD54d21c3072077947e807d3bd21c2ea299
SHA1b7a5e859a9046c859f62e02b5d267ab1cead05af
SHA25628ef1d5a79570cebf284da9526477b4cc81a4039ca1ebccc103942ca0da3cb78
SHA512df4c2fd0f7ce886e2881b4a6a1820e45d118a9ed953c3cc3965beef2aa2ddf1e126e673feca943af97d19652cba49f080b924098251d7e70455ad7c8ea25ee55
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
846B
MD587422ff2ae5cb8cef7fed501c103eb49
SHA1b28e4337074b95d7955353677c372c6e9f4c6258
SHA256b143a92d08c9b9a959f69d3bb36028cf13645c689dadffedc8b106420de8c081
SHA512118a22026b93f3589547bd256df7e13cc1368f5382919a3ebb094bc6f07dd00288b5e2c134ce9d705295a8f5a9ab14720a91ff8ab8c92b2b9bc229c422c234c2
-
Filesize
9KB
MD52920be7aa6794a03bb521c45a9581007
SHA115dfddf6ee5412bae1426dff6e42b8b02496b1a1
SHA2560dba9059be89f07cef2d0824f4030c0cebf0382e07313a4cb60c5246b3e50d44
SHA5121ded66e115762e218b6568adc853e2ac5ed38db0df3ef6e0b2c0f1cd62196000e2e3e513c9a69daef14b0c23c328842fc940eb0aa4d11c36c853bc733d0da574
-
Filesize
9KB
MD52b533d5f4fa783e74ede1758fadf4592
SHA198481300b387cef301925e7d2060192f8161245b
SHA2560892e10cc9a3a3744b2f4d42e50b5422064c643dbf539e60d02906c720aaa146
SHA512fa02e46a04363da073e6c8650dd5fd380387248d5b61635d876fd2f2470b9af55287b49b2e5ff13d6e39693e2c5e88d5b41c6a681a8d4ef7b17a793c1cc4e64a
-
Filesize
99KB
MD54597c497c73de31eb809a31aee335ade
SHA1cb4a41e82d1b176dcbe9dced212c2f71aabeda7b
SHA256fe56e26f9896f54b807964dafd7ec1b089062b509ed0947dc187f016f6259547
SHA512f5faa4b3e8d76c7c75e643d7d41d8461e623b94521bd0718f676cff2daba97bc9d674e39cb1aaf47bf1fdff4e6e4c4642a89b22559a9b38301433c2341db304f