Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 21:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://protect-eu.mimecast.com/s/Vxz6CW7O9h9zlREInOlEP
Resource
win10v2004-20230703-en
General
-
Target
https://protect-eu.mimecast.com/s/Vxz6CW7O9h9zlREInOlEP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341881433435849" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3688 chrome.exe 3688 chrome.exe 2064 chrome.exe 2064 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe Token: SeShutdownPrivilege 3688 chrome.exe Token: SeCreatePagefilePrivilege 3688 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe 3688 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 1756 3688 chrome.exe 67 PID 3688 wrote to memory of 1756 3688 chrome.exe 67 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1620 3688 chrome.exe 86 PID 3688 wrote to memory of 1712 3688 chrome.exe 87 PID 3688 wrote to memory of 1712 3688 chrome.exe 87 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88 PID 3688 wrote to memory of 5064 3688 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect-eu.mimecast.com/s/Vxz6CW7O9h9zlREInOlEP1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1d429758,0x7ffd1d429768,0x7ffd1d4297782⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:22⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:82⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:82⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:12⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:12⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:12⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:82⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:82⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1876,i,25695593815927029,14498506478273596982,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD59e67d013f2e60dfd6c44c1ecd0210a40
SHA1313c1dc5d4d471a6bcc8f0cbcb02fc2391585947
SHA256f9487683e0d2364f1c79a7cf3c8af5127b83984ec62a4b07896f81249dd8666a
SHA512f454bf43d169804432e314624ceec41767b718804572d67142b21fdffa0def6e80246fa6f8939c1c764ccc2e2a3a09d7fbbb5a2641f7423e6985729deae998cb
-
Filesize
216B
MD5b5ceddad89e2cdde359db518141271b8
SHA1a6f987fef410ccce9f658d27aca9b7bc0855d9e4
SHA256372a07265c5fabb004c8ed1894488195a4a4cbaeb3af21428add1738a3525d5a
SHA512b3998177325a766fa9a9686dac10e57e47bf7639a0421c098d3f2ef9f58ce443790e5f8a6ee4aedb4aa423eded8b5b20b12fec4f33ab985d862456af26071c68
-
Filesize
4KB
MD5055e271d5edbd763214b3a6905b79ced
SHA14072b65dd6840ec86b6ac0205cd4a80d6824fb2f
SHA2561fcc218249e8d82cf5be2ba1526fcce407deba2534e55fb01d60c6ea44cc4a11
SHA5124fdec226a986967e28f73015dfbd76ed50456c72670b108df68ec959bd135949e089e86605e9f62bc6bf8ef43871be2149a284bbfb1c5fc437107a3175de9e21
-
Filesize
3KB
MD5eb84799c5cd544d5c5630b7c245552c4
SHA1876f7cc75ed46b739375198326ea60488b16a14a
SHA25608f8543cfbea8a18c42fa422b592ec1b26f421b6e710fb87e52d0467b574ee59
SHA5122f1466c8f203e9a0860f119f2fafa5b691e32924ce0cbfb20dbd642f9ea3452fd3f829957b58cfee848a6ae2d710968b53302020098e98a0c5a809312fd68262
-
Filesize
1KB
MD5902891d5b95dc04c20d66366a4d3b715
SHA100e2796b43da45e6062c19ee544ec4f1b6cf5a7c
SHA2564c2f7789e7f2737df880c1ec7a462c5cb3512bbd656bb5fafb4e1e5a0a66f475
SHA51264d3a1fd237b4c8ff99d4a9efa8f29d4f92a5c38c093d9582197610d6336f52e74235389d7ef75187f797e1e77201d35208fd43b52bb305a78a6d3139b4ceb66
-
Filesize
1KB
MD55c44e00c9c0d5d1c654168ab05eccf97
SHA1db9e3c551244227ad2a4e0e8b8e0beb704b8e721
SHA25696866bc30c6e478a5bbe4c3392d59b8d9ca71c974db51eff8e0d25ba50e58b12
SHA51295edd754e82ab42cbfaf2a72f9eff90c624ec2bc9653147e1b3fff1ffa987110a924acfce782d01915170ed566318b316ec03ab1090e88b6dba5c290304b3d9b
-
Filesize
6KB
MD5bc7b7d0f0d998843f0565c260b9cbc9e
SHA14a65c2151c05306edc19f0642de1c407571bdd28
SHA256dc8a6286bc127c215129cce06f1941968da3637f09c51c257e4536108cc03aab
SHA51253e7ad0250ad2a50c657116c474882ccb37cc014a69086f120d4cbae8251af019e6bc121a51e836a092720b405c546bb53fd198f91283d4ffe1c5f185e105a97
-
Filesize
6KB
MD54e83bf3d3023df5db97921ac1e4aa2f5
SHA11f5899e8daaa8b7f6fb1cdded39c977642209d33
SHA2563837af6d5ce0f43d54b67dba3e6cbcbdb6d5da2f2a72f7f5d8da174a08f83829
SHA512fe9a1ec30d2e092f1de0d5adddd1965fa12a3189ab560dcb3970cf8e21283e542f7cf5426f3745e2dc8791a0cd8deb286b2c43fa8e21ed8086d0ce0051f6939c
-
Filesize
87KB
MD5b7d209085ff9cf4a6697b4a1bf011cb8
SHA1a0e1cd1a654d0c3c692d709d9ba4be9b9af7013f
SHA2567c12f65a52f45cb422e189a11069e697c3452795226a6e4f620ffa4cc6bcaec7
SHA51203bb8875eb7173d7509f7a5ca5b7320567e3dfac01d6a2a7908413c59aa898155cf53ad1e19ba9f10a17aed8238a50c510f44f6501251e8e9567421a63826c20
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd