Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 08:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ckwdi.socialmedialions.com/4rqWro17400geuh1542odbslvkoup14017JJQORDGNKWZGHSN50259FPXN19875P9
Resource
win10v2004-20241007-en
General
-
Target
http://ckwdi.socialmedialions.com/4rqWro17400geuh1542odbslvkoup14017JJQORDGNKWZGHSN50259FPXN19875P9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133731956968975085" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2100 chrome.exe 2100 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2100 chrome.exe 2100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe Token: SeShutdownPrivilege 2100 chrome.exe Token: SeCreatePagefilePrivilege 2100 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe 2100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 652 2100 chrome.exe 83 PID 2100 wrote to memory of 652 2100 chrome.exe 83 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2388 2100 chrome.exe 84 PID 2100 wrote to memory of 2836 2100 chrome.exe 85 PID 2100 wrote to memory of 2836 2100 chrome.exe 85 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86 PID 2100 wrote to memory of 1136 2100 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ckwdi.socialmedialions.com/4rqWro17400geuh1542odbslvkoup14017JJQORDGNKWZGHSN50259FPXN19875P91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff877bfcc40,0x7ff877bfcc4c,0x7ff877bfcc582⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1868 /prefetch:22⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2156 /prefetch:32⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2384 /prefetch:82⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,16679503967752885016,16178504925495997513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3864 /prefetch:82⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b1cb83c74ecf926650669363c57d12e2
SHA1bbe0a07ff3809af9a279bdc9f988b0ad893b4175
SHA256620ba7085e55c78409e5ff577b11ffbb30697d4468c78023c6590d50b639a322
SHA512c57771ef0a302c0dc5ff86d0fa0b63be2a9cb36acd76f6f7b6d4e5fdd05ce3e8f40b0d1cd5532f61a64a5ae2af3857183dfaf8c1df43d51aa19e3f66456d8818
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD5f192a8da995bfe5a03c35518e0790592
SHA1568a4868eb2d6f9cca1f7dc493526d22115f5204
SHA256d22919aabd217e2f027ee8c5f5de6d5230f7d280cccd680ee8897a83dcf0ab85
SHA51221b3bbacb19740b5433dba9364522a3d8f5f19b97bcafba38187ca6c0175f4460dc9c90031994b937ccb86635cd9ca064b01c08ec961707855f3def174232321
-
Filesize
116KB
MD591062ccff356b31e5404055d7327fa27
SHA13228b9b0cb6dbf6462ef6162ae6d188c7ae3bd6c
SHA256960859416fbb6bc7b29e3278c63e76d3f73627212e2875aa19c794740bdf49bc
SHA51243d3f32f8771b8a2ab9c4774ce79284a6dec07474e5bb8d2951f41b42734ee0acc4f8c1ebcb49a73086585ed6cddd309f018c4e68ab4a581c0ce8c95edcc5706
-
Filesize
116KB
MD5be139661e69e071deb96ea5949aaee72
SHA1c3638adb782d57f7c1ed27ed9b73bdb1b96e53d7
SHA256dd97181f96be91a962b07a3dcd2dcff5b6521d4ba47ffe0a97f634f1c2897df1
SHA512d800b311aee2af81773cda28d40edf76e1385f964037868b7ec77ec28b449c9c51b019d33a25ac13a52da5778fffb97287d325357ea4c82feb99bf4537466997
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58