Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 17:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://captcha-verification-v20.b-cdn.net
Resource
win10v2004-20241007-en
General
-
Target
http://captcha-verification-v20.b-cdn.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133736601434283083" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 912 chrome.exe 912 chrome.exe 912 chrome.exe 912 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe Token: SeShutdownPrivilege 4276 chrome.exe Token: SeCreatePagefilePrivilege 4276 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe 4276 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 2132 4276 chrome.exe 84 PID 4276 wrote to memory of 2132 4276 chrome.exe 84 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 4684 4276 chrome.exe 85 PID 4276 wrote to memory of 2120 4276 chrome.exe 86 PID 4276 wrote to memory of 2120 4276 chrome.exe 86 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87 PID 4276 wrote to memory of 2320 4276 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://captcha-verification-v20.b-cdn.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa90c5cc40,0x7ffa90c5cc4c,0x7ffa90c5cc582⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1888 /prefetch:22⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:32⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2268 /prefetch:82⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:12⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3036,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3668 /prefetch:12⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3472,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3464 /prefetch:82⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4880,i,9822085883550388636,14736257605498124634,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD529653404501459380371ab611a8ee7b2
SHA1efe056b812ff3552dfe3dce0e84679d0028ef825
SHA25633ba9f5acf7dbb969f66a8415f1cf870250328f48d0b63d54881f07beb30809c
SHA51295401c15c5f1b42b4aa40cedab0c69f9470bc9c1f2fba7d09b89f7851b8f29e5b3addbb102763892a0bd2d59c553173c30791357d38249ae2f4ec08bed013373
-
Filesize
2KB
MD5f3d22573642b55daf4dcf45f9ee6998b
SHA1267f94740f14c95d6b84795e0c6cf191f9179081
SHA256fa0d223ed0c6c9b5527a1c0a8471c1e9a02ebb38a93e7ce4dc8639ab9d459de1
SHA51278bddb2f4f8d3543bc758e1baf4947b9242693199c15454a3972190d360903227f96f8e4eca9fa3f208ee174efeac5a03f30cda75523f435141ff8e038292338
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD591d832951367aafc70183077a5bc3375
SHA1fae497fc788317a92f8312b169fd6f80ead386aa
SHA256e79d0094c76dae5e006baa32be127dbfb8e335a3fa3b27080d307a1814540bb3
SHA512b0fbe78d2618fbbb7a11418044d4126eb1fbb2ff09af0edb96ca265e1321f195bff0527f6aad217a02df345c4bc6f9d69cc4606f88ec5794ac1360af13edc2b0
-
Filesize
9KB
MD5a917999e44e25789ac9a684da5c44cf2
SHA1be183aa560a5b4aaedad75feda31da51a1907f11
SHA256f14803e35f5d62010f65c6c7296c870f0025255ce44dd599a9e1bf8bc4390ae1
SHA51297b4dced533539fc5810e3ba52e9c3fddf3beb11965e456d7ee7dd85efa3333ad82ca5ddfa64498ce93fe1ac817ba6309f31c772279deed25149fbfdb5b79074
-
Filesize
9KB
MD522f48910e4025c71358466c1c9758f8e
SHA17ec80f10ff1a8f7d25dbb094fc8f73165d43e8ae
SHA25696b03cf7a2766b7a9f6d432790937f9ec685d44feb9f192fbefb9630d693de28
SHA512bd130e4785dedbbb246b2c4869d42e60504d1a28db927aab0ec15aefa9028352643e8f7735aa3a4adf3e940c195e0b077f9464c787d6bb6ad669da13862b0169
-
Filesize
9KB
MD50a45240772aa75a94a10ef8469b78b4b
SHA1e9a185c014bc0f2df305dd211d38cbe4d824e746
SHA256c3312186f085efe3a87c9e5272ea35b6a4d7cfdcf44dd7905115226423179d0f
SHA512436518942defb0eb9b66d71c6a9472d0af3016c2df6f47a7e7e57ed52860d007c1e0f8b05661b5abaaf60b2c29367ea8d63d8ac6ffa0cc98327b6a8259e276ae
-
Filesize
9KB
MD56dc3a0e7c224555709403a6f974a61de
SHA15d3cd785597a67a944f9fba073ac13b33fabccde
SHA25697d33446c24c563c6efe1bbd504fc664b28787f3b4bce777adef278469e50a1c
SHA512ed0e09257b3f5207c69a04aadfd49be4d34ef4c43cee99c8a087b23e77e130b632c2116ddd231c8b8e26101474451ab1ae8f51062996e87d74dab1323093d6c3
-
Filesize
9KB
MD598dbf2d1ed58e24d373a892c082a9008
SHA1491518ade56ab84cba48cb131090e50630caf79a
SHA256728384b40d64ad7147f1b7abc0ab56e20a34e76df2a905ceba55acb20533be38
SHA512470582db3669df40b9a44b68a3d1ae88411250a80ffade5c0a11fd7b24159db5bbfa08e52c42842996a12f83bb9960f5a41cbf0180c445e2722be7022f1d6d13
-
Filesize
9KB
MD5e39c0e51fc41fc32fe0605105f91f4c4
SHA11dba74aca38f233126363f789e3bb5ff4b21bb2a
SHA2568abbdad89ac9921e817572393e66200080ad401dd83ed0ce1c669fb73c5efa42
SHA512ad87f635507110d4211910506f7700f2163ccf4d02f884e71a563e2432c2e8187b97b16cb1bf0e8835163d0cd97dd521691ccc849d1fd33b31622e07c761beb6
-
Filesize
116KB
MD52aef55b3e7b5eda53a6d17e5062a6eee
SHA1f5ee447967d137bcf01a2680c54bc81ff48675df
SHA2564d65697686a1ae708b01e8ffa2ee794913d026739a15924be03e52118014c602
SHA5122f6cd525fa29780b6bb4c7b841a0d207e93da6d1b9d256f18341223982cb755be995832cb47268690087055adf7dac2dadac24ea9015c6dc4d6f73dc0bab8b47
-
Filesize
116KB
MD56a8a5d198cfed27d10538777f135a711
SHA1f593f9aa84d46601becc96f5bdf7cbae2e5c67c2
SHA256699172f5915e526d65768776cf2cd9d15a091d723428473a41291d12ba1e5356
SHA51243334b90dd7831681c554c5d0149f211ce4c89c653405a94808f22a01f892b5f0653c9e2c65372281c78b07b3d4652d7b19721739975a0a2325718902038e648