Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2023, 04:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://iontuition.us20.list-manage.com/track/click?u=3864594c0beba7cf01a2fb737&id=803ae9771d&e=ab71407fb5
Resource
win10v2004-20230220-en
General
-
Target
https://iontuition.us20.list-manage.com/track/click?u=3864594c0beba7cf01a2fb737&id=803ae9771d&e=ab71407fb5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241101155288721" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3772 chrome.exe 3772 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe Token: SeShutdownPrivilege 3772 chrome.exe Token: SeCreatePagefilePrivilege 3772 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe 3772 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3772 wrote to memory of 2036 3772 chrome.exe 85 PID 3772 wrote to memory of 2036 3772 chrome.exe 85 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 4776 3772 chrome.exe 86 PID 3772 wrote to memory of 2216 3772 chrome.exe 87 PID 3772 wrote to memory of 2216 3772 chrome.exe 87 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88 PID 3772 wrote to memory of 3848 3772 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://iontuition.us20.list-manage.com/track/click?u=3864594c0beba7cf01a2fb737&id=803ae9771d&e=ab71407fb51⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffab769758,0x7fffab769768,0x7fffab7697782⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:22⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:82⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:82⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:12⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3204 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:82⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1816,i,12783700476768381904,9265498210062783121,131072 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD518691a33352c88e55fa8cb0269960f30
SHA13091011c2e5722039f9be21884bdc309b01118a0
SHA256553cfa69bd849a75148268a42ca8fb4f836f1a9f7d66df3018cb9af77675b35c
SHA51210500da411a56320a715c1e78cd164906b536e41c2365bbbabb49368e4796573a909c03d30e65305adf90a6fba69eabc90a9eb3377a7eadd3b2ad1eafe36cc9c
-
Filesize
6KB
MD51aabd23edd5fd61e812e6c447112b888
SHA14562c92219faf64235170ee98fbae8f62cd5e54d
SHA256ccea369cf34c41608371ecd56009b745f3d26c7f41a376e44a53d93c435b8227
SHA512b3a1bf63c25e37390347aef545bbd771483bb6ce52ec5110fd26da556103561cc848a62289d3028e003b44d3ae6eb0e6dd6419da0a625a96412345e1c09730f1
-
Filesize
15KB
MD51bd496e2d56c4015b40f10ed79d46a9a
SHA140d4eaf27e222ed4425beca3faaaec23c743a5de
SHA2562a23c40d9df79036d4f59356137867c75dfa72fa2d5450f919fb51dfd889f871
SHA51284ec7efa5f19732fc6d532e3950adec66e8d2cd44fe4b0e0019f4500b44cac251f6f35243269cb2adfabc9a9dbb7ca03cdf2c5941d80a8c5b400266b788cfa69
-
Filesize
145KB
MD54d5f27037a30b9fdf900263328276b17
SHA1910a25cc12d0a355c8c55e923add362bb18f7f41
SHA256a064cee19908f451e53f10296bb7a74d1355a266bff5cac144e61b863ecb7ebd
SHA5124ee44751e33f2711c9bafc0e2f5da6327314b5837a3d43366b955634865b89df702ffc572ffcff2f8fc91f6cf534b23bf726eac06c5ecf461de59a9b98f47ec9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd