Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 18:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/drive/u/1/folders/1GE7epoTIUQXONNi5Ua3bFkBzwBd8q405
Resource
win10v2004-20250129-en
General
-
Target
https://drive.google.com/drive/u/1/folders/1GE7epoTIUQXONNi5Ua3bFkBzwBd8q405
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 drive.google.com 4 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133831679633347047" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4288 chrome.exe 4288 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4288 chrome.exe 4288 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe Token: SeShutdownPrivilege 4288 chrome.exe Token: SeCreatePagefilePrivilege 4288 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe 4288 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 4280 4288 chrome.exe 83 PID 4288 wrote to memory of 4280 4288 chrome.exe 83 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 416 4288 chrome.exe 84 PID 4288 wrote to memory of 764 4288 chrome.exe 85 PID 4288 wrote to memory of 764 4288 chrome.exe 85 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86 PID 4288 wrote to memory of 1736 4288 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/u/1/folders/1GE7epoTIUQXONNi5Ua3bFkBzwBd8q4051⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6cfecc40,0x7ffb6cfecc4c,0x7ffb6cfecc582⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2160 /prefetch:32⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4696 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214KB
MD5ba958dfa97ba4abe328dce19c50cd19c
SHA1122405a9536dd824adcc446c3f0f3a971c94f1b1
SHA2563124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607
SHA512aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf
-
Filesize
1KB
MD5642342d9c4d72dace365fc666d33cc2a
SHA1a48ce2cabd0b763356ec1732204b6bcd1f918964
SHA2565c33580271734cd82b96def545258159a606c71a3c8fe173bf4a1ee64f7262db
SHA5121057dbdab89e95c5b5982abd1959ef0f52a51140fd28577993d9b7144f2c89296a9fb69cd94c63adb0146b419294014fbee149b076965aa0fe6fddcb2285b007
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8ff2a925-2e27-4a85-9852-5aa15b7dc9d6.tmp
Filesize1KB
MD5518ab88c6d3e61bee049500ba4fc8187
SHA1e8a353fb5022cc9cac7f1abda65aee25444ea71b
SHA2569d9fb9cad39720b28e36f35f278c1ed292a7e8c87b01e94b70237a069ed95a2b
SHA512a41532773ca2481fa49a368db49f4ca06e46f35426cb8d548d38f4a91c84c9c33db9237e912b4a55fab1626066c1ba520108da50d7014dedbf9a4ebe71a802d3
-
Filesize
5KB
MD5dd0c42506a6ea03a737901912d091a67
SHA11d7ed9f4ad7a999b8ed13f449bb4b60b12cb1322
SHA2563b6299d0d40baf45b558e6e768e22ea197656cd8489cab1e2cb1f9fe52d36328
SHA512b389c38af31ba1114b074672d4a705674bf21ba958c24d66aaa436e09b21bc77494740bb3fbf464e4245e496d4c671b30c10d0f92bb8c463ff5ae3c7fd5394f1
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD50fb740c25582385c41c8e2638876a1f2
SHA1bf89a544758ae8d2359c62753453ccd7bc99747d
SHA2560c1a51c62c7b0ea53e4ed9c2a023cb8ae55b298703ec2c3d31f81885cb2e41a2
SHA512e7aa16d398077d871d3d2a26bff25b1be403bbd2946af285f9ddc1567218695dcba93857f9b7c78696f43c34d193259f3bd85c6391a2a2acbb51f3b47cc0c819
-
Filesize
1KB
MD514793f28d76f874f9c08f708d66659e2
SHA1efeb18f085f82227ac33eaa7b989e26cbab21180
SHA256fd5d178f96ac851816e0493a64649fcbc5d7357dbd01dc13319a4cc3cdfefeea
SHA512be2020de5784a4a36dd059e2d7e9f7ef686fd75d279fa1a557e3aa9671d87b73b0e3a3d3c51446c0d8a3b1964a68ac16df5c74d79388ac06216485f0c1bcd967
-
Filesize
9KB
MD57d4f55116ad6e0f78767a5327dd1f4e0
SHA1250f614df7af33a60181c351d36bbc11a6f69a1f
SHA256e7d87e657944b9210bad026b5b82c32d6fa901a5f45ae4debc5eac81e7a7eb34
SHA51241771095d91c35f437d3915685985e23aca6e1adc1f005b9c98779150c13f3e3b3cf1fbaf2de24085e8aa51052cbbcb35a7289177d4200bce30b47b2daf0d80c
-
Filesize
9KB
MD5493bca9ada66e12208d44e20e3202487
SHA14315933e4bd11d197c4ff6e2710e95180d6d42eb
SHA25668d9c59078c6d4a6ba90ea6f38e226800cdd3654707d96dab60b1cefb4f54dfc
SHA5124d05f7323e18ab99f31f66753912731d7279a621c54ca9e04ea7569c8c9d8d2728c4b3b56c3988e006db7b44d68a203941110c3aea3201652f9d035e4ff0f27a
-
Filesize
8KB
MD52bde4729d24c1336a469edf6bd3dc5a9
SHA1f328b030e06ece84554838f42d9649cf9c1af9e5
SHA256eb9177d08e74f6b689121f182bef3614945ef7a4ed43f604ca1cf00cba2a7374
SHA51204371ab6c47122a6fb78a7d074382da829f1a77450e9cb0a17582eb59c56fe326823a1460c276469dcbee06a7258e13d0ea5da73a064c2cb211de3042d00623d
-
Filesize
9KB
MD559a11ac6f7ea545684e69538c70696db
SHA1e9c6981da48d684fc27535cf9a843c0bb5acdadf
SHA2569d2b060e43dd2fbd782edbeea42f8e0ad30eeda149b2339e73aeeada68fc0644
SHA51242f14f4e42e864c948df14b07110cab1803992c26295508340317bdc5dbdeacdd786f57ab6b54c43615693a743f893d85385eda63e471e04a0c3af1f2d839524
-
Filesize
9KB
MD557ea2dee1c3ab084e4dc769985c451ac
SHA158f8cbf60ed351811a14796905834c630c2f6fe3
SHA25688dadcd7a778e9dca333f4d4808c907b358c5ca7c83f270db6348a7aaca3f5a0
SHA5129a3426353be3cf61050a9854d222c5f6ca2ec27b7475daae3ea77a6703f41dd82c7e36b1299a7f3bb7724ccf6f5462a88a9a4850677051dca7449103b89898ed
-
Filesize
122KB
MD549a56b18ae409356fa54c43877a4a4cf
SHA1563237c04627cbb48e74605482d4136da82e3f63
SHA25613165ca86f96930ee0bb0efeb085692fdf6510d16bb3e160789ce1af4e63fbba
SHA512d53545c01c7d698ea08572b9002b867367cf3fdd63ab7b5be977a8b631fa75ac925015ab067cd32b1a7e8285346c0dad8a441cf9b1563b469640cd8f30ed72e6
-
Filesize
122KB
MD5262210b5e37af175a2e5a94e63fd4e84
SHA1bfd48bfe52ab3f8e6719e98863006d1d39b9b101
SHA2560cfa5eea46bedce679fc116da957b072d89a4b9af7a3e2b11d647801c33b9865
SHA512cdd09ef42817f884017b93d23ebb4270f0260262555a1ec963df47310473b477bd2cc81e00819162b02fe7a9a72cb405d5a028cdd6729d3d065e8280ba50953a