Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 01:10
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133814634675598225" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2344 chrome.exe 2344 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2344 chrome.exe 2344 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe Token: SeShutdownPrivilege 2344 chrome.exe Token: SeCreatePagefilePrivilege 2344 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe 2344 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2452 2344 chrome.exe 82 PID 2344 wrote to memory of 2452 2344 chrome.exe 82 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3548 2344 chrome.exe 83 PID 2344 wrote to memory of 3164 2344 chrome.exe 84 PID 2344 wrote to memory of 3164 2344 chrome.exe 84 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85 PID 2344 wrote to memory of 4312 2344 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://navi54.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80d76cc40,0x7ff80d76cc4c,0x7ff80d76cc582⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:32⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2396 /prefetch:82⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:82⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD55738b5c0e0f42a3c81cad56a591315ba
SHA1dfc588e5f3b1762f8d382a0cc3c0e5b485a49e93
SHA25669c77a17a769ecd8fe574ced38a9a7813227f982891f1ccb20e7184c115a2c9b
SHA5127d04680ef0cc19350021c0c330a16547ff697d0d3cd0b04673d5f8398ce5302afd5b83488a6be215ef71c8aac404c2044a0ed68defe419eeaf4dd03c4732e332
-
Filesize
192B
MD5aa238bc6beb32fd4470ec3863139ece3
SHA1779acb7f37b17e1fec020205886a3e0aa6db8a32
SHA256bd10c342c82ad6a42cf30efec6d622f0c267c0965d1effd67efdd66f80dd826d
SHA51226f2147dc41f8c06e77db59aa72535550265ecd7a4584ac9af808789a9d7e28f17d116739259fcd15fe88ab93a5020d2ad8623b74daad0250b21a8aacaa2218b
-
Filesize
168B
MD5092a8e3269450bd462affc1f958448fd
SHA1a4fd03372099627e8847d80f2e3f14766ea3bdab
SHA2562662c8db3b575b0007a8ff75fcedf28ed3ab5d33868b13eaef749f28831cb8f9
SHA512dfea5f227ade65f755bef25369bf0957f13e51008704819876926158a0d3e1a9f5962e187cfd268eb9912f987da9d470fb5e0bc4e27b3e0f5c42acf736e43aa5
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD58f39a79f8319f87e88b377586111361d
SHA108d73b2e2b1a7768c57de400198c17ba73ecf40d
SHA256b432ffd375ec2b000fcced6c510e6283ae1acdb2808ff66a291e3e6019b7d03e
SHA512489df565d518b933bff9d2a99a696adfb02d03824578c4deb23ae8cf9429e159128b17021aed11f9ccbd728d9ced9637389ea9a994a8d117eed162e540666c0d
-
Filesize
1KB
MD59628405e82bbba0457ac66168358c573
SHA19cd92088a68a7b6295b9a2e9860295cff9dd1381
SHA2563e095d53319f9cd3415f5f6d493eb9303bcc715959633f833c92d3584d905c5e
SHA512cc79420fd04895fc75d2d4b4a4311828cacebdfed5e44665ed65933a1f904fa449d446acfe0ebcd9c4717272929fb3e1cc8ec96c002d0aaa38856bebc4557aac
-
Filesize
1KB
MD56ed45146f2ee1900185e8c537fd80c57
SHA183574c0401f0c4cb3dbf49cb65027207a57797ea
SHA2561bedcd1d26f4625f364be6dde84bae87b254253274ecf55c3ebd1ec092905594
SHA51211f17ebec39a639dcc9373510eb688224afb495db3a90d21cf7811374a3c24554030b9c9e0745de6e7712ae8a89342b029c6ba5038a6c6f4ed821b8190f404c1
-
Filesize
9KB
MD5c5d88a8793ff5b1160d2c285c708ea14
SHA18e4bf4ff376f416b1ab55ed2edacc85ceb1ddda4
SHA256aa7fb57935529de30ad3d73c9e47d38c0433e69ec1fdc1af554ac24624f8bd9e
SHA512e52527c160fb1b270d095a628a5ce2ed8614574d3893b2cbee9b09eab992618b3b2817f8d28bf6c70683a5b05bab8ce308b627358e508e20b9728fe7fe9ce735
-
Filesize
9KB
MD51507460c049eb6bf4e1b83274ba6d7f9
SHA1fd08d3275cdf642dbe57ef5a2f80026f2431424f
SHA25651e23dd0784bf0fab7cedb5688e0d177af1d4fe69a416fcace86fd72be30e128
SHA512c8367b9fc0f58e7d3a13a4c9459b8f6cd68ee7f233d3d0e1a7b3ee7c199a72d67ba61aef5212c0e659e17922a12d01e5c73fe730010420997e45b7220b362573
-
Filesize
9KB
MD56b8e023295c0526b92d339ca5012cbef
SHA1dbca68ebefd6831c0d33ae2a217e475a6dff9735
SHA256d0dd93b7f5fba04d0238e8fd173f39a3251a171db290a6352ad95568a52247c8
SHA512c9434cfaf8c08aac2d508099d389eb3852c1dba16790b834a7f0064601a2017be6682bc2518c50be0ca21ee9faf48e8ec778088815df6dda1ce5456e8666d7c2
-
Filesize
9KB
MD5448b511ca05b2dc94ddfcb45611d2908
SHA1a23979a07b1bbb1f07cd99f3729477ce38a8ebd2
SHA256f066a367b7e5df3a116de6fa1fa65011ddc5d5368d9753803db25db8d874eec1
SHA512aa994e57e1480181dd4958300587030787ac755382b1167d1d80beafc8312348dc6d20c25172128c0d448956708fdc487b34173afecdbd6737a7ceb610cd15b5
-
Filesize
116KB
MD51bd0bc9c4ce2cda0d46ab28fb14a29ca
SHA1e0dea1bf649a7c7dfae80f33c14e2fd2b99e89fb
SHA2564158a474a28a7e0fa1d92506ecc8914e6aac74f10c78c6ff644d0ccd6233b685
SHA512ca342881f366f2140f67f580072e16ab93b8c51021fc71a6c69dcdd356ceee1edb4319037383f0a88265803b87f9f9282bc4c0c8f53172bc3451560a7e644acb
-
Filesize
116KB
MD510f963f664bcb8adc0c684f6996cce2b
SHA132370ecc0e28778d7e4ef2ac9419a55fba51ac1a
SHA2560ed254cea248d6891a3dc74ee4117eb8e7fc0fb250e6fd5ed1d8987ebdbd4f71
SHA512879c4446b4a3db35177ba1c371a7600d080a237b454347e69a7a888d153d3be6722389e8fba86d8aef46e257bfa807743ddd3fa0fccadead1507726bc41b3f51