Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 00:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ac6b90e95bcf6184f26701ced2385eba078eea1c9843001b1653869877cc7367
Resource
win10v2004-20241007-en
General
-
Target
http://ac6b90e95bcf6184f26701ced2385eba078eea1c9843001b1653869877cc7367
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133729940573770923" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2252 chrome.exe 2252 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe Token: SeShutdownPrivilege 2252 chrome.exe Token: SeCreatePagefilePrivilege 2252 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe 2252 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 4012 2252 chrome.exe 83 PID 2252 wrote to memory of 4012 2252 chrome.exe 83 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 2200 2252 chrome.exe 84 PID 2252 wrote to memory of 1856 2252 chrome.exe 85 PID 2252 wrote to memory of 1856 2252 chrome.exe 85 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86 PID 2252 wrote to memory of 4300 2252 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ac6b90e95bcf6184f26701ced2385eba078eea1c9843001b1653869877cc73671⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef7e1cc40,0x7ffef7e1cc4c,0x7ffef7e1cc582⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:32⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2376 /prefetch:82⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3112 /prefetch:12⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3832,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3052,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:82⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5024,i,1038193333770407083,16900135823214323980,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD5e1790259372d3b6bb7722c9cd60ebcc2
SHA17f7f0e4d38b0e0ae4369e23e256a4894e1d03bf0
SHA2566926072ed9f3352637509ba91d1e29ee77314fb750a4da87c17eac94ac6786c1
SHA512fb22c58dd52be84de091219a5abbfee6cfbd7e336ac1e6fec325e47f811d24db4aabf68cded538c015f927a49b49496f7c0c2346bcbfe4f3401990e3329f259e
-
Filesize
8KB
MD5507e2d72459037142688bbfc28993b64
SHA1980b9c67c060db01219a67a72aa1be91db49a9f3
SHA2560b1c52b8b1e33f8b4bd3ef8aa8979eb16869ce0a3b4400185b9f88f397278086
SHA512e8851f9b759fadb57d48a906a2b8676dc78d524a0a37217cdcda63d0144f6a4f499c3a73ca17b68e1b004bf28bb651d1c7bbbcec8cc510559342cfc8f613d787
-
Filesize
116KB
MD53645592866ff21750094c3e200a4f212
SHA1574c0f3bdd9d1d78d27fafa87646870062277ab1
SHA256f8a09334caf01a22108b0de13ad669bf79d3912b97ec132e3cf34f48bbfe1677
SHA5128816e3ae070f83087c0856fe5339a6197f45aa5fb57e72eb8e6646005e90740a1a6e411dbf620739c2bc76bb03729e1dd880c7a54429d3f16b6b0a28ad47ca20