Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2023, 16:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mautic.avicennaresearch.com/r/82f5ee9148850ad42c9172ef9?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czoxNDoiY2FtcGFpZ24uZXZlbnQiO2k6MTtpOjIwNzt9czo1OiJlbWFpbCI7aTozMDtzOjQ6InN0YXQiO3M6MjI6IjY1MWVjMWUwMTdjZWQ3MjE0MTMyMzYiO3M6NDoibGVhZCI7czo2OiIxNDg2NjQiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjMwO319&
Resource
win10v2004-20230915-en
General
-
Target
https://mautic.avicennaresearch.com/r/82f5ee9148850ad42c9172ef9?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czoxNDoiY2FtcGFpZ24uZXZlbnQiO2k6MTtpOjIwNzt9czo1OiJlbWFpbCI7aTozMDtzOjQ6InN0YXQiO3M6MjI6IjY1MWVjMWUwMTdjZWQ3MjE0MTMyMzYiO3M6NDoibGVhZCI7czo2OiIxNDg2NjQiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjMwO319&
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3048 chrome.exe 3048 chrome.exe 3416 chrome.exe 3416 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe Token: SeShutdownPrivilege 3048 chrome.exe Token: SeCreatePagefilePrivilege 3048 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1772 3048 chrome.exe 84 PID 3048 wrote to memory of 1772 3048 chrome.exe 84 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3344 3048 chrome.exe 87 PID 3048 wrote to memory of 3832 3048 chrome.exe 88 PID 3048 wrote to memory of 3832 3048 chrome.exe 88 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89 PID 3048 wrote to memory of 3864 3048 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mautic.avicennaresearch.com/r/82f5ee9148850ad42c9172ef9?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czoxNDoiY2FtcGFpZ24uZXZlbnQiO2k6MTtpOjIwNzt9czo1OiJlbWFpbCI7aTozMDtzOjQ6InN0YXQiO3M6MjI6IjY1MWVjMWUwMTdjZWQ3MjE0MTMyMzYiO3M6NDoibGVhZCI7czo2OiIxNDg2NjQiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjMwO319&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbca759758,0x7ffbca759768,0x7ffbca7597782⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:22⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:82⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:82⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:12⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:12⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:12⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:82⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:82⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
528B
MD5f40450716bdc8222287714776b6ac5d8
SHA18ccdfab2f901037310c9d5b6ae016b5942f128c8
SHA2562cbcf17c9476f17dd57abb431b17eed9a4deef5b4d8cae35c80736d094be6436
SHA51223f336ec7f49230e3c6248edcf4255b100f8d949b3edb11cef2935cafed29628d7ebb1e32940687ab1e230e536ea6d8b2832b0a5b46edbb94fb645cc927b9b9f
-
Filesize
3KB
MD579c9bc9ffe222fe7a3265e04778c931e
SHA131249a83521f1eb73fe16188246e649ff709745f
SHA256e1f6aa3d44e962496f6dd68c8c384b59af190751dc262dc4ae4e07c070f6f1b5
SHA5124e1495d56d969a9c59f6b20a7833a61494a79e8969adf20695377247bfb6e983d815e5ab44dd59f0bdda14252c103bf03d3e996e21ca302f93a385308586e4ab
-
Filesize
3KB
MD5ab351b6a005c4ea1c76f1170bc238395
SHA1a85dad543a61120d5c9cf473d4b8265fb9c6da87
SHA256c14c712c5a6a1e365dc6f094c2b683b4f68ed3990f9fc3a57f3637c54d0454a6
SHA512d2d741af6800740acd70e59206d8589ac68d58292a1b050c2e28f4ba0140beb7333563d8ea72556843de4cd68b73ac1bdf21a4599a743b6e0bb80d6df92fa5e5
-
Filesize
864B
MD51c661ee60ce504b8263705fbc98a0361
SHA10046caf22080d7399502c0491bdea157dfe82bf4
SHA256107ce1d92d0b4c6a0249c4308a34261414cecf8f25c548986d2c34747fa1479e
SHA512b930e2d6b9ea0a3489ae0a13c100fbcf45270abb77168f38a7814a9d8315e4128db55e68d5da7c4e070663a2ede786950fa52e828890f92492ded85f0bb018b3
-
Filesize
6KB
MD5cf0536f0044e03ac33e3cfc21cb2d602
SHA1a0e289de44a1e415f8636b4a4e73271c704a0d5f
SHA256708b606b666bb463e5b7996bf84ea8a0639ac145f897c84e07b008f9c9634fbb
SHA512c7a0ab29f76160f75551fe0c327cc83b3c98a0e86636849bc0352f000fae8cd6c166d313f266f3332e94df56f36e05e57376713a96b2a5042a7efa0d9264729b
-
Filesize
6KB
MD5f7afa6a2ba6a7f79eed8b0fa84a7b2e4
SHA185baeb48b828e52ce2887f07b932902d26d1d7af
SHA25663b8dad74fdfa1f9eea9edf5d28154c74c1f62ecc2fe19c958b7477448a12bb2
SHA51269fdc343e11c085e5ed5aaaa1f9c205aa3b6a42ee695e8b29988ab40999684831f4d460c12bdc9ad4ed92a354b6017fb1c42b23323c53245e6a5565197d53293
-
Filesize
101KB
MD5e6e5ad021e5eeadb2ae89c1952becc7a
SHA130e73d8869da664725fd3bd933c553c2130ede57
SHA2566086a211bd0cf572c48a93cf0f2a13a12daf2c22b0a72dae7c47ae99cfc0becc
SHA512aee600f2f8182df38b9f4804a51c3dd42623ae686e423ab44e59a1d02466b3529439cda8e0550c94595b9948f530bebaa51555fc194d0e31f96a4f1836031d25
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd