Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 20:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomunmity.com/glft/771243
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
https://steamcomunmity.com/glft/771243
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
https://steamcomunmity.com/glft/771243
Resource
win11-20241023-en
General
-
Target
https://steamcomunmity.com/glft/771243
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133822243102320395" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 3848 chrome.exe 3848 chrome.exe 3848 chrome.exe 3848 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe Token: SeShutdownPrivilege 1684 chrome.exe Token: SeCreatePagefilePrivilege 1684 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe 1684 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2876 1684 chrome.exe 82 PID 1684 wrote to memory of 2876 1684 chrome.exe 82 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 4408 1684 chrome.exe 84 PID 1684 wrote to memory of 2764 1684 chrome.exe 85 PID 1684 wrote to memory of 2764 1684 chrome.exe 85 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86 PID 1684 wrote to memory of 4664 1684 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcomunmity.com/glft/7712431⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xdc,0xe0,0xd4,0xd8,0x104,0x7ffa6df9cc40,0x7ffa6df9cc4c,0x7ffa6df9cc582⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:32⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3736,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:12⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3372,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4868,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4724
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD58f9fc86c2ae6834c8c43f10037de670d
SHA13212f9215885c8795959727059ef0e2b33241475
SHA2565b0f728a10973d37b2d73a8ab3f709260ab9039aeff31e469b2c7a92da5e3d29
SHA512ad46f52c1eb9884c59d6eb20f631d0ce73cf0bc7f1c7eac8aff91b45fd58f9e2c45b356cf6eea2518a00c3ea6ac7daf67377d0e017d4e405984f8b4025742d62
-
Filesize
216B
MD592747456eb98c5b51cf2db49a7d7877a
SHA147cb51b03bf28bf045cd7616e3f483e60804b651
SHA256dad8acbca7e614a636c2a5cff17620bb633e7ae997fc61fca55ba65642d8d7e2
SHA51231ed7751449debc8070b9ceedeb1d8be15e8f86004e64a7ceefea947fd299e68a9b4ac76607c9efcacc97ad7e2c1acf457c6309249e13b82a4de1c628a3d4f7b
-
Filesize
2KB
MD54f4fe99403a8aec0046782fbbcdb48d7
SHA18d5f3ee168ee6c1158e20ac3c644227d04a77a11
SHA256b3ba2ec645b50675acd25c386ac60a88370bee854182acb37ecba0ff16fca332
SHA512ba2012124f0b98107c7b72e05e5f32eb660b483379fd010dfbed51b38d634a3871e10818835efd9fe82512d5b5df38d268e58b434b416c1e642c8857092101c3
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5e8a285f0b173a59bc2ba15f685869819
SHA1c593bab11756b0db4cf4c4924e1928f228dbe374
SHA256d7909c50b258aa1622391d43b7dc0ac9d54fe7bc6361ef646207df6d02e74013
SHA51258a0e710ed9853b672cf3d5334fb42bd197aabd0ba564b4508344f0a80369abd7005779498594663e08fb24627f1cc67b94eea3f2f2b2de62a73b7a2d6709bdb
-
Filesize
9KB
MD5e68090a066990f714f58b4f568f8bd2f
SHA19d509df9b75cf6b3dd865f8bd5ada850c75a4aaf
SHA2567d5cd106d041a55717ea182473ea5be878df2d839702a38418e17750f8a65c98
SHA512139acfb9e47ed8e6353784c7f2a0a0361294ab85e529b59f3ea75bad12cf73495f2756259476e563d058beb93787bd7307e10ea72d69e05a3fc383616e1e6613
-
Filesize
9KB
MD5ff7f4b3ccc477bdd3c4b08a7f4d99d6b
SHA166f8833fdc23a396f6c351ce69eaf0b24a62348f
SHA256491915e1ea056038f16122abc8db23a57093539cc2255edcbb90cf8cf60888fa
SHA51294d9f81d68699302e7a0c90403ddd7a99a4427900e9b40eed76514ce78d7049ca8e103717e0d69a70755d81a3c25e335e616ea4e81f38272a6916f0b6fd70818
-
Filesize
9KB
MD5f72ccead57dc93d273ef6f6293b0a2cd
SHA169b79eff17b98339d20bc1acad1cae5722f0ee16
SHA25624819e8f619ed1481d843aaf018ceef1701b2909e0dc8a170524b29f029af4fb
SHA5126755c2906ab85bbfbe3e3137f5faac2752a1ec7f1a014c3a8b726b9bf8962b60cba07a02241064d05278f5b48fdd64fba4f60b7c37e7cd95b33eec9d4e8f08d3
-
Filesize
9KB
MD5a35e3c4dd8715d7834fa8d5ab3e866c4
SHA168fd2b4e693572b6ed28028a7f34326f3705fb2a
SHA256ff9796d0b1830b118be835ba6997cd0c9b00e47796a31a66ae64b8b9c25e9f4d
SHA5126926a1aebdc1189ae99f3c58f3c98b014bf9b2ed6e0272ffaa1f3ee4af5dd5c26576d3b71f60db4f0e281f4ce351886cecbf103e2e5b34cefd52693af33ad5c8
-
Filesize
9KB
MD54020c3bc8df4b5caf7cbee6a7e8b2cae
SHA1a8309fd4de5ee720197089c0b47794d144630ea9
SHA25633f536ebdb97b3815ac8da197c4a80fbe08dede0308f7f669ee2450a4fdd4fca
SHA5129f7d47561815ea0b091ff5ea066542a10db1a2cfdd87160ab15fcaa5b499ccad2e7f8235e83784d31e8557dade5e5fa36342eda2f37bd6733a460721c8ce912e
-
Filesize
116KB
MD5b67b7988bdafe830c9018036d965b735
SHA156223c98b0ed6057d67b27903f60927d2620e228
SHA2562667d086193cff308a141302238d55bb27b1fb62787c64ff063165f973839ce6
SHA512696ffdb8fe528b089db861f91afd63814c7b63d588da5c77a1061cd4567d8340d10da020d6e3e138a088b783fe067610505532f01539630952ae3f803770bf70
-
Filesize
116KB
MD596aa5e91f454c758a1f95e28d92c4008
SHA144f0fadba5ca0e2ae96b8157f188c2685268fbe3
SHA2560d0324afa6a99713d532c13f5dcdf520ebf878a7064c9f31ac9d2e90c7365a19
SHA5123fe5830ced4274c8ef13994892f22765d276bb95648b915990741cd6820df863f288b12d5cdb36f2d093c283d5637abc074332b660fe7d974945065f075df78a