Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13/09/2024, 17:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hrcestudentforms.42web.io/
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
150 seconds
General
-
Target
https://hrcestudentforms.42web.io/
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133707226839936955" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 1784 chrome.exe 1784 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 1296 4092 chrome.exe 73 PID 4092 wrote to memory of 1296 4092 chrome.exe 73 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3596 4092 chrome.exe 75 PID 4092 wrote to memory of 3616 4092 chrome.exe 76 PID 4092 wrote to memory of 3616 4092 chrome.exe 76 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77 PID 4092 wrote to memory of 3240 4092 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hrcestudentforms.42web.io/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa67369758,0x7ffa67369768,0x7ffa673697782⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:22⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:82⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2816 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3564 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3088 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4264 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4312 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3820 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2360 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3080 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:12⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1808,i,17041037868372996487,18387650854476733115,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a293305556e9d6b6a26d63cb664a33db
SHA178782a4ad13dd7f9ff44e028b0e8cae8788cf084
SHA256c78f8911c99d53f81e3beb474b0e885ce0e1209ed6695a38b2e32e7e897c9d8a
SHA51214b67eb1bac6d66e565d2d5b8199a7163d97e3004cebf182f69272edcd9f2120f838bfa414afed643fc3a59141dbe8e2b9dc839a65f530325d87155d223d5000
-
Filesize
5KB
MD52c78332caba328c69951f6fc697b7af2
SHA1d3663920dc37b32b89bc7de7df7e23a0f47112ff
SHA256208208de65de25d8d8289646a97fc254ef23dee5949c04c664805eeb83d9f1a3
SHA5129196d157ba30bb5e3bede292cf2cafaf270a3782e0fe62368d105d6859698daddc7adf9fd8d06f24dd9729e7e63e2aa0d750cbdac58abeacca5bab5a4c1a3d4f
-
Filesize
5KB
MD564bf657aeb01c48e27d9f0aae77d0b95
SHA1c95fcc29b2e10d9048da3165f87d31bb1354e783
SHA2566645b55bf893d123b1454d3cbc682cf6e9323e9fe40b18ab9f91bf288ec69dcd
SHA5121cb820492862ecf676f31551c82a4cd3627000f66934d62e550138b3ac743f9a6b05d87db67e46707745279352680c16efc87a4cee1228072c40211ad981a4d9
-
Filesize
136KB
MD5144854c117d4faee2c3ceaf8dac790dc
SHA19ad78ea1e054792dc84733e7b409daf88f989482
SHA256386cb76219059c4636c3e3dbd1fe22a5340fff11044bfcb478f810a558304363
SHA512804345bcb616da6bbfa5e2293796df767851f93ea5642cf49f3e80f2ecdca66ba2f449192870cded87e29244addea48c43c238ddf834334df8cde377e8cd3705
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd