Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 19:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://info1.lionbridge.com/unsubscribeConfirm/1004732/b3acef8d93f86d2e8842064d6b6c15737a7887ae4d4ebf52bcaf15e9cfebfe60/5197291435
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://info1.lionbridge.com/unsubscribeConfirm/1004732/b3acef8d93f86d2e8842064d6b6c15737a7887ae4d4ebf52bcaf15e9cfebfe60/5197291435
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133312430602679859" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2128 chrome.exe 2128 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2128 chrome.exe 2128 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe Token: SeShutdownPrivilege 2128 chrome.exe Token: SeCreatePagefilePrivilege 2128 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe 2128 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2796 2128 chrome.exe 84 PID 2128 wrote to memory of 2796 2128 chrome.exe 84 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 3620 2128 chrome.exe 86 PID 2128 wrote to memory of 4784 2128 chrome.exe 87 PID 2128 wrote to memory of 4784 2128 chrome.exe 87 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88 PID 2128 wrote to memory of 4544 2128 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://info1.lionbridge.com/unsubscribeConfirm/1004732/b3acef8d93f86d2e8842064d6b6c15737a7887ae4d4ebf52bcaf15e9cfebfe60/51972914351⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa60969758,0x7ffa60969768,0x7ffa609697782⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:22⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:82⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:82⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:12⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:82⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1796,i,12323729791680035094,12893131878655589042,131072 /prefetch:82⤵PID:488
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD55fdbfcf71b4fe7339f91023d18fcc0ea
SHA1b072e579853e4f263b768ee02bcfa28db6bc2c05
SHA256d2802cc8751d8c3a0f42290d245c11fa5953f7079d4f7e083b7a8461b5cffd5b
SHA512dcbb4e7944e3f410eb4c113ce0abadcefe0f0b567e3c46d5deb8146d394453faad19c89bda3d7523e5ac40a44f8ed0a966b13d51214b3dcf486b55181595fcd5
-
Filesize
4KB
MD526d6a08186f4c2c9235fc6ecbfdaba5c
SHA18496a2dcc1b69a18b2be893b76a7ba064a4fb107
SHA2565744f9da87a3cc4aad5dbb8340231f5a1a783bbb49ba3ca3319d11f05244dfe8
SHA5128bd73bb41ca8cda9ceb72f248704ae8a4597d495846b1caefab2738f760b3855c3dbffdb16740ab6a269e198c7b7eae4cc1b521aa8560b62f8fe0486b3886529
-
Filesize
160KB
MD5f7ca1e6918c417f20d0a94fbdaa9e536
SHA11f01f56ee2bcc31cccd34dd937e3197255c68da2
SHA25610988660d8deb9c69ba32ed415b23d120d6813d9d7d646770c3769891d71a465
SHA512993095696582f6edad7d40c833fd36815f87b25d6afc6cf4cd88f97a777ca89d5be83ea98a44500e7b20db798fc4ba5066a32571757f6846c297c6ad0229ea01