Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
54s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31/03/2023, 15:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://corporatienl.us18.list-manage.com/track/click?u=c4977b49f8b62dd1f1d2577aa&id=bfc78c1fd1&e=a37488e326
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://corporatienl.us18.list-manage.com/track/click?u=c4977b49f8b62dd1f1d2577aa&id=bfc78c1fd1&e=a37488e326
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4204 chrome.exe 4204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe Token: SeShutdownPrivilege 4204 chrome.exe Token: SeCreatePagefilePrivilege 4204 chrome.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe 4204 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4204 wrote to memory of 4144 4204 chrome.exe 66 PID 4204 wrote to memory of 4144 4204 chrome.exe 66 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 1220 4204 chrome.exe 69 PID 4204 wrote to memory of 5080 4204 chrome.exe 68 PID 4204 wrote to memory of 5080 4204 chrome.exe 68 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70 PID 4204 wrote to memory of 420 4204 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://corporatienl.us18.list-manage.com/track/click?u=c4977b49f8b62dd1f1d2577aa&id=bfc78c1fd1&e=a37488e3261⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9d65f9758,0x7ff9d65f9768,0x7ff9d65f97782⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:22⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2020 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:82⤵PID:420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:12⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:12⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:12⤵PID:4148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3332 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:12⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5228 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:82⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1740,i,1796140051756524555,1245676015362221678,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD567ea48c291788e4786563ed5c47cd7b0
SHA1184561424e17e59b773a6fae2300962102790a14
SHA2565d231b0aa438698dd57b072ae6bfd3400d4f8def654e72c040b83f22cc8acebd
SHA512a0205718f8100092a4be03cc6350ca0933184d22755c186ae8a0bd6d488bfcd9e94de27ddac9789f3db72ac7c1e92d16d59c2cf86388ecd921901c0b8b535853
-
Filesize
1KB
MD512725d5bcaebea2c826efc9ae5f95ca6
SHA1a38b308eb85659c4478b29b38c6af21dcf8b9b26
SHA256bd9b830b81492f9d2b26c8c075bd2c0e17b0d0881ce648d1e3b83d0d80abf0f5
SHA5125e206943faceb1c36615e80632a25b0d4dd69dffe9be13bb6925c3558c600475b631e34859e7e7807c3f3ae059bc4a1cfe9a68204579e84a3738b45f63a21dd5
-
Filesize
5KB
MD5638b08482fef1a80f7d15bff984b7796
SHA121b0d9b5e1f18d45c9c2b5a6c4cf26fbdcd81a86
SHA25629db7359403f243cbce0e95eaa72c9e263fc78626c8d15d4971d7390de12f11c
SHA512a11d182afb86a3677462b5a29b2f17150e93901920afa26e482096c32bdaef23547b4ebae802cdba2662e861ab0e090dfa0104e9d34a608e3bda6cec5906a3ef
-
Filesize
173KB
MD57bcabf9f15a77f098dfb2744439331a4
SHA14e46207fefbdfa95c977aeed273b897401058b4e
SHA2563442a5cd2bd03647dc0c91a6aa1c5013db6cc26be54e9279daedfa266a6d77dd
SHA5127d74ee674f48ad5fbe3631b2eb2bc0da6340f1a55829b4096f065ccb633e1b4b1bbc8b2de9b53401622b36ed79b4db7486d17175c21b51d2532a05f60dfc0b20