Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 15:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://m4a.cetrixsolutions.com/email/unsubscribe/64b94b059590b168086456
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://m4a.cetrixsolutions.com/email/unsubscribe/64b94b059590b168086456
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133343392685195378" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe Token: SeShutdownPrivilege 3152 chrome.exe Token: SeCreatePagefilePrivilege 3152 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe 3152 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2964 3152 chrome.exe 65 PID 3152 wrote to memory of 2964 3152 chrome.exe 65 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 4152 3152 chrome.exe 88 PID 3152 wrote to memory of 2260 3152 chrome.exe 89 PID 3152 wrote to memory of 2260 3152 chrome.exe 89 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90 PID 3152 wrote to memory of 4420 3152 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://m4a.cetrixsolutions.com/email/unsubscribe/64b94b059590b1680864561⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffe218e9758,0x7ffe218e9768,0x7ffe218e97782⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:22⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:82⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:82⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:12⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:82⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1888,i,3587058292608300799,8665431185851700951,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50ab20078e8e051145e90c553d8e9b54e
SHA166f90476f76e610e1a7908444bd16bb0e17c8584
SHA256776c3f035abfac1b121cc8942dadddc3f7b150ea95698910c46ab7a95f200e58
SHA512b44237f457a4425baacb38ef41cf65386f6edb856613eb0c9fb9cb1d7153a7d08ec96a546e9b585b33ba2ef7c914bb24b98c592735257036d5834c64fceed4c6
-
Filesize
706B
MD5aabab0fef466e1fe35822691236ffb0c
SHA16ccabe25c1f7e3aafe8d2a5f5013fe99420df5c7
SHA25652d4f4805adc560a7759540b5a06c0e055a69c04418c97b15256541f3817be6e
SHA512585e1ef5b7ef080fd89bfd20fa1e408fb35fa6fa3152e8a53cb80d14b7d1b034ecb9ad483aa4939f3892ff6e09f78449b4f084c573624bfdfec5a49e6934b551
-
Filesize
5KB
MD5bd9bfa0f3e14f45bbfe9608a77bff9a3
SHA1b044040b65459ae62d60db16d57c0b42922b4df2
SHA2566ad261763535b318ff2a85a13d3b4084ab10276abbbcaa1d05f223f1aded6063
SHA512bf1204b20e4bad9cb5520bc7636e0a4274371f790feca16272230df16260dd05b2884f6454d0fbc4b2b1aff5c72aa1e13bcd8f26ef33eea9fd22b61143bc433a
-
Filesize
5KB
MD5e248164a594496f540fabf9331eb7a9f
SHA1ccd051b3e6695ef514eac2fa502161175a2e9e24
SHA256ac2fd993e6b3d9b317ad66b168a48b99632c61b523c63a46e4c67a7e686feb25
SHA5126f8a2ba54b083ff2f31820ff2e00d5dd5e0c55e6d622d7206f8bb7e1eeb9d81bcab7e10e8b608f15a52983e03c441f8700317578b2280a748b9e37522f251db4
-
Filesize
6KB
MD538db2960524fb644db90568c23afcc15
SHA1e64d86b0a8537e0e4828255c9f1950c885684465
SHA256ac306eb050d7b78e6ebb6fd8dfeb2e3f7b28e4ef626c7d89359ce1640184b559
SHA5120f1af2d36fbe8deba9d67c43504fd4eb424cfbea823d8fe5161541a144b4b3ed8850109da107dae3c6602af4e1d37d4ddfcb9b7a7229aeeb36f1c599310efd4f
-
Filesize
87KB
MD513ea22fad2c37824d70b0d9d9c2f2de4
SHA1258bb8e5a5ce41da97070e0086d3ad528f74454a
SHA256e4bf7a1daa9965552bd7f3d02701afdc5cb35e563d086b2afa59d195074356a1
SHA512f50a176774a544833c4005c1fe8f33087c033add4da3ca2bea5140811d3f710c052060c2d81dad90ae914d31164ab2b8834b3e985bc48424c2abf57c727155b6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd