Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2023, 03:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://securemail.commonspirit.org/formpostdir/securereader?id=VuWLWO4dJ4mFTjezWOXdYVIUEkM59ekP&brand=3502e25accec17455
Resource
win10v2004-20230220-en
General
-
Target
https://securemail.commonspirit.org/formpostdir/securereader?id=VuWLWO4dJ4mFTjezWOXdYVIUEkM59ekP&brand=3502e25accec17455
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{46ED75EB-189F-4FCD-9C3D-61F5BEE629E8}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B40A30BB-6AA9-4AD4-8525-D42514F8C45C}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133283417073736463" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1832 chrome.exe 1832 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe Token: SeShutdownPrivilege 1832 chrome.exe Token: SeCreatePagefilePrivilege 1832 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe 1832 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2304 1832 chrome.exe 79 PID 1832 wrote to memory of 2304 1832 chrome.exe 79 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4972 1832 chrome.exe 84 PID 1832 wrote to memory of 4748 1832 chrome.exe 85 PID 1832 wrote to memory of 4748 1832 chrome.exe 85 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 PID 1832 wrote to memory of 1440 1832 chrome.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://securemail.commonspirit.org/formpostdir/securereader?id=VuWLWO4dJ4mFTjezWOXdYVIUEkM59ekP&brand=3502e25accec174551⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce86b9758,0x7ffce86b9768,0x7ffce86b97782⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:22⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:82⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:82⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:82⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4984 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3436 --field-trial-handle=1816,i,3086521158235500640,198650119414992374,131072 /prefetch:12⤵PID:1772
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2616
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD5b785ea0d5eb25bc69a04fdd0d7658545
SHA11044ab95cf82039fda7345909556e65862914e4b
SHA256e728c577309535e7d1d57ca6e625a6517765ad2d4f747b60e177ac0a31f0334f
SHA512fc9d473649e148a8b6977c6fe4c6eaafadfe9ab55189012d179dd01339dd3188bdcc824da4a12ba147b7da0147fc804f26b63d21f96fbc891338ee7d0717c8c3
-
Filesize
4KB
MD5fdb4d579bf3c303268546c8e93ef5b44
SHA17c4b4a2bae857127f7b57f8610c49d219229d733
SHA25660a37ea3d07241a932c84905d3ad2a997437dce022698fe5b57d1582fde54a2c
SHA51243878cad1a67161a563c8dbb5cb75e1cfa0e16c179cd43bb5f1df9b93990ffcfe40dab3bd5496ad0c19ca8ca5f431e1502505f31d64f88ae5b4d592fed84093a
-
Filesize
4KB
MD5ebd8c00ea802c4bd3fcbd74491089fe5
SHA1d82c8b4df1adeb976deb36be0ff930c8172b5252
SHA2567e551a92c1c96d0078ede6dfd0a70454d0aacc613a43226c339cc4270aabf159
SHA5124d54e6a5d16c3290392d2e18612f790e8c6d74b3a50f953be61f1411ee7c47bf801edb00055d47a031f20bab106a216d0bdae94990f852fa8d244db0c2fe31b6
-
Filesize
149KB
MD50e247b553778ccd18fffc35c063693e5
SHA1d87438fc69a8bebc51dcd8519f3c85b14eb546c2
SHA2564970873a1ea66e91d076bd4186ecbc706416fdeb828bb74456cb8c91c5d3fd42
SHA51283b7f545c531757807dc79ded20f5b96c2abd8c5b3ad42e5bd1b2e6677fbd5edfbc6c5690415f0e4477fd6c3145f296167a5c5b3df9de2f3bc25c2711e9c5947