Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://test-progress.neom.com
Resource
win10v2004-20240802-en
General
-
Target
http://test-progress.neom.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133711983575489055" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 4428 1424 chrome.exe 82 PID 1424 wrote to memory of 4428 1424 chrome.exe 82 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 2680 1424 chrome.exe 83 PID 1424 wrote to memory of 3868 1424 chrome.exe 84 PID 1424 wrote to memory of 3868 1424 chrome.exe 84 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85 PID 1424 wrote to memory of 4552 1424 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://test-progress.neom.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff493cc40,0x7ffff493cc4c,0x7ffff493cc582⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1796 /prefetch:22⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2088 /prefetch:32⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2436 /prefetch:82⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3060,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3028,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3652 /prefetch:12⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4688,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4728 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=208,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3376,i,4966143101392403214,8867395444696051992,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4fcd946c-76ee-4ffc-8772-8db872c75d82.tmp
Filesize9KB
MD5581dbe1366284d9fa67ca1d62c354dff
SHA16af035c9bc5ca6b12afac679a4f17f87119e42aa
SHA256ed2f7b33cc07ca795f448c8245147210dfc64fa62b6e6c918ea5e193a32e420d
SHA51269f612d58facac84b4feedaa88eccace81aa092e41f972eaadb1f7a6e47805d7b65b14686b5d4ac442f7dc4ea7d5071a121e2d160939e5d00ba09d9b9ba3e1f3
-
Filesize
649B
MD594665c004f8d874adb71f11d6693eb56
SHA1c699973ebe71bc943a627cfcbb1cae35571acd01
SHA2563141d1257d5e52e3691af4d7bd9f58f3aa3aa547753dc84575110ad0cef318a0
SHA5124517f6eca15dbc2b060e1b7f6f6a06823968591f6fc30eda016a959e60dd917a0fc109039ae41d92d406bc0ede0a1585894e410dd01d78f66ca1b3fbf50be9fe
-
Filesize
1KB
MD58ad22bd30fd4669a17444ca9c1ee843e
SHA1ab2c8ab845ab4a9c253a393244ea86915c702f1e
SHA256fc0732f3fda94a6ade9348599638385e4ea4a5e73fab3d797231f8a7e137aa98
SHA512a8a04e9ec9fb5c17e770f8fc75cdf8d7995a9bdcc0bb92588afe58d202cb4b27ce62f334a13b97618f280e0a6e332601991dbe28292d07ef550eb1c4b3fc53eb
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5b70ac2630d23c8cab44c8b063fe80bbf
SHA1ae38eea114fbc41bdca09f4ec0f45c56e165fcfa
SHA256bf97d67ad15880c417f420947a3c3de4015481db4bcb728895b14458cf80d5b0
SHA512ea99601de272e856c9ea122529dbaa9db2d624634221928666a90a531a45c74a56b37aeabf6336df982916b3b55b7292a01d4f4b246c212e13878d2ac30ce233
-
Filesize
9KB
MD5ab8923aa44bfe2082925b2d91aa77120
SHA1e8e48cba84a9aa69d029dfada7f10cb92fbed202
SHA25660bd6d508de9f2a65ce4afd12c75244a05a44c00bfd168b92603552a9a952963
SHA51236de15fce36c36ec83a38908cc142e0f1beba3755a646baed4e3ece0371e6e5116e5e0151fc23549e5d7540520a5bdf92d5810f3615c1dcf66ca2489689f88b0
-
Filesize
9KB
MD56973de8d26c14934041dcd2ecfb7c509
SHA11ded52438fd934c2e7dba561f6c16cc66bec59ed
SHA2562f407fa4affbecc8d4ebd09f917683a3132bc3fc15b43c60e525e4ea4242d9db
SHA51246cfba83fae208110de99f76007e0194f6c3ff12f133d22708eea9da9dea77beba1061e21413ea268af70f43e71f1673ad5a54011bc5e55d029d48c320d4f3ba
-
Filesize
9KB
MD5a3351c46869473fd6b551d9ab6ecac75
SHA1af4d72e935439d029990323d4d1401de79044c89
SHA256d142224ad451fe3ee76c249eff1c4dc3e026fdee3f39c3a3ef4a05e655d0e93a
SHA5125d60e163a8372c5e0dbd76d3b21c60a7c3b7cb551e6023c54434d23ac0159a1a2f81ea235017dc0d3c436f989a8d876a3437707d811af570e64c305403300c8e
-
Filesize
9KB
MD5e55ee83e8d8fdd424acee3394da5c83d
SHA140cf72f39c7ed744f7557c66df82268c74c5dd94
SHA2563273e99e04c65295ba7b3952ff2c12f95774d760823ad54155138a8e87163fd7
SHA512dad2e04ac2ee0dc8050af7b9cc41db3f496d2e5825bae414739252406528208a52b680c8ddbd1f9ff82c1b91e4df4561bedff16d1e7946ca0f15f36f4dde7a4f
-
Filesize
99KB
MD5bab9fb48b5c470eb1c349180a4613d3d
SHA11f7c186b16727793afbf9d6d46fddac1929e3ed2
SHA256ea1f7e1c46a76e6bbd837f2e757bf8d4c0caa4e8b4d2e5274f37d89deaafe680
SHA512456db172a2451cba0b3df17e1e9223e5e56789c82f6b10f6dc88ba4da921f20ae7d9fd1a9a895699273b77acd80ba1a8000c94c6a64654ed73ccb51c9ed432c3
-
Filesize
99KB
MD57b46af1c056379378e1643a674832cc6
SHA1bc92e9837383725919773d43698e4162c2dc438c
SHA256308c46d11f657e4f0760fffb3d4663e7d49a0aac0fbc56a97a0a4551142f8efc
SHA5122f79de42f3285d22caf45505460fdf0778154d259fafd0fadbec0d9ee8b6e64302dd38b6be5399232e9d2539a06c971157847cf9febf51c4a5d9be26b7a66518
-
Filesize
99KB
MD574ea564a346b72bf5b692c8ed4787092
SHA10000efed1908c948f24dc92183d7fa5958c92a57
SHA256bea36da1a5aa929206034e3de75b1eb054792b5dd384e9d011775c355c70c30d
SHA512c5958795e74acccacba57892e88168ab59c7a2f4f303cb77edbceed767522b8d956db783988779c90c2022c6e080dc04821616d2ce4a1857cd62afc994908196