Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 20:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://securemail.ensignservices.net/formpostdir/securereader?id=p4zpPmq3zqJBlKyf8-KDV42riesvubvl&brand=f75c9f4f
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
60 seconds
General
-
Target
https://securemail.ensignservices.net/formpostdir/securereader?id=p4zpPmq3zqJBlKyf8-KDV42riesvubvl&brand=f75c9f4f
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133343594868389273" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3348 wrote to memory of 380 3348 chrome.exe 86 PID 3348 wrote to memory of 380 3348 chrome.exe 86 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 3032 3348 chrome.exe 88 PID 3348 wrote to memory of 4280 3348 chrome.exe 89 PID 3348 wrote to memory of 4280 3348 chrome.exe 89 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90 PID 3348 wrote to memory of 4484 3348 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://securemail.ensignservices.net/formpostdir/securereader?id=p4zpPmq3zqJBlKyf8-KDV42riesvubvl&brand=f75c9f4f1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8d859758,0x7ffc8d859768,0x7ffc8d8597782⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:22⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:82⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:82⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:12⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:12⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:82⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1972,i,1373980472136913537,1691253818384349591,131072 /prefetch:82⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5d4da3fd37274e2356515c39f759f6f1b
SHA1747e4f6651fab489a857f06805b6af4f41b6ebb5
SHA25657915a23a14a2812ae8b76557bb9adf34b11eb89af7270673dfb4fe196951794
SHA512b0fb1cdce46ce54659d3137313ebe64443f406e30595a51e97be50a3af83c91fad91930648501f483d4188dc93aa71083a2c98478fcbc8cbf1d1995d93f4a830
-
Filesize
538B
MD55e606140c95359cc27d3aed5538571db
SHA1bf2b6b648df6715e16988bd6c0a05ff63e8d72ea
SHA256020fd5f6b5f9854b80f0615ff0765e8cb5809b520c41bab7cacdc0887f263815
SHA512f6454bf317ad3e9b42e5fc1dd926d692202665966dc1185b0c5cffd808b125ecfcbd42b0234a2632577e234ade6e94ae8269d3b7a828f613ceaa278db8aa54e5
-
Filesize
6KB
MD5dfbcde9684124163feaa11bcc5a44ea7
SHA1dcfa7a1a8eedbf96151b644ab5ecc9fb2c99f727
SHA2567defe4b02b8fee257ead595c5bcd391219c4dcef74b7e2b7b7f2b7190d60c3da
SHA5128cd48a74cb7ed697dd9d9a63e7ecfbac23dca6890e601c3edd3f9d84314f16e611d232a8df4285ab63bfbb9dab6ac60fe451d163103469c5bfa015891ff72f77
-
Filesize
6KB
MD5089a1b58c7a87b6fc492c16eaddbf618
SHA14c72be84c30146661e22413fe5c7111d0ea2fe41
SHA256d8b4b6807036a9d949e635f9759560924c4a7b5eba1e119f03656b2928958544
SHA5126021274618fe10c7e15568a4a6c158bc8daca088efc03dbec5e341821d9b03cb08a33b0aec9d51295cf230f504b86ca10447bf0a7c1f18a3ff0c52fb81a67f74
-
Filesize
87KB
MD5296f55e48029f8e91b57fdd13b95bb0e
SHA1d28fb3223d23c280e74b9254849effb65fa1a569
SHA25683e89181dea029d66afa023e2bcd1f3fbe0cfbd7607da94b6df59c585bf0e7dd
SHA5128812c10810ff46f83d1f91ece81db831dd02630b002089ceeb82abd3d156b098b98ad8abc9a94a4dfcffa92679355e3c3836ecbc73886629b8e573b2c7d654e5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd