Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
17/05/2023, 08:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://protect-eu.mimecast.com/s/d6CBCXMAjc6oOJ2T6fzYp?domain=mail-attachement-microsoftuser-content-61667.portmap.host
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://protect-eu.mimecast.com/s/d6CBCXMAjc6oOJ2T6fzYp?domain=mail-attachement-microsoftuser-content-61667.portmap.host
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133287916062472361" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4956 chrome.exe 4956 chrome.exe 4004 chrome.exe 4004 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1352 4956 chrome.exe 66 PID 4956 wrote to memory of 1352 4956 chrome.exe 66 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 1572 4956 chrome.exe 69 PID 4956 wrote to memory of 3936 4956 chrome.exe 68 PID 4956 wrote to memory of 3936 4956 chrome.exe 68 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70 PID 4956 wrote to memory of 1496 4956 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://protect-eu.mimecast.com/s/d6CBCXMAjc6oOJ2T6fzYp?domain=mail-attachement-microsoftuser-content-61667.portmap.host1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd65f79758,0x7ffd65f79768,0x7ffd65f797782⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:82⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:22⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:82⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:82⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4880 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3300 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4528 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2628 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4200 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2464 --field-trial-handle=1752,i,16518320641929225316,1993746146422235704,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4004
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD5628f781c19ded3c1a0ede62c0cf611d8
SHA12ef4b6052dc53d583347200f3ff3af5b5a979a74
SHA2565ea4aa7722345221f1af452ae8f58c15e9424bf759b4b3e40baa3c966dd75a5c
SHA5128b6bbe4955b74df18002c44a484bf5e08790f3774ebcbb98055f14be3449d3c286106bfe863658ee652bdb09965af934ab9edcf68e86e763cbb8d8c545dd4db7
-
Filesize
5KB
MD5e881008ff078bfab0fabf3c494553f85
SHA10d21bac05c3fb2fc420090c24e8ecb3a36a0d9d9
SHA256d739094040070dd6e4009eea009465c8b7276c5f1569c17e1f6e1af9d3d78a31
SHA51274dba7cafabda418dd504c7154a2cfdf5f1c869b0e1e41d4c45af8548c29dc09aaa143d51f407dd19c44fe59116434b46984046f62219f1fc0299a6a1d3e26b1
-
Filesize
5KB
MD5cca6a06fda72a4c152db999a6bc75895
SHA11de8c7b00ba210de94b691da65c04d42963787a0
SHA2563824909dc31fed2cf7c33ad3dea4fb967b6d2675a6381b0f621435f46ba104d9
SHA51219a6f7a8ff8fd515769e925e0de04b1474293ccd02a8d041d0e13907ea79fe705c84395180a1edb6af215d37dee2649c0ea0553b20576e7ca6cd0ceadf1ab244
-
Filesize
5KB
MD5fabd2675b5419ba7ef89fd79e5d26244
SHA1180b6c4c083188dd68a33ae73413177e9a8db5b5
SHA2565dd273496c9d7a87475e2aad6f69dbc9d6999fe789156f3732dec8fa9044c8c2
SHA512dfba24f577f60a83962d7fd0b8dfa477f476b961310931d01204004a1034c5825347b40c66932ecbf147dc2ceeb716d3ae3c862e3900c5474b45d11e78ae5bb2
-
Filesize
151KB
MD53456b440757eaa74d9c74865cafd7ca6
SHA12dfccf8c8905d10f2c1cf99adf52a53b8bc3df05
SHA25632fe889495c1787316a0aa739429b1671d9f635e05f9f7ab0a54af50ba006f2b
SHA512b3645ca4d16cc6d02143e2dabd15fd85e8a4bc96a3caff09331b5b065288d733ecedb1e363673630e0777dd831db0c0474760f199151674d72041a9ea17f537c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd