Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 05:18
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://app.getresponse.com/click.html?x=a62b&lc=hZ3AKc&mc=Jf&s=BOlOIab&u=IFEwb&z=EG42wk4&#amFkZS50YXlsb3JAYWN1cmlzLmNvbQ==
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://app.getresponse.com/click.html?x=a62b&lc=hZ3AKc&mc=Jf&s=BOlOIab&u=IFEwb&z=EG42wk4&#amFkZS50YXlsb3JAYWN1cmlzLmNvbQ==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133444991267928014" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 664 2088 chrome.exe 22 PID 2088 wrote to memory of 664 2088 chrome.exe 22 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 1672 2088 chrome.exe 93 PID 2088 wrote to memory of 540 2088 chrome.exe 94 PID 2088 wrote to memory of 540 2088 chrome.exe 94 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95 PID 2088 wrote to memory of 3232 2088 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.getresponse.com/click.html?x=a62b&lc=hZ3AKc&mc=Jf&s=BOlOIab&u=IFEwb&z=EG42wk4&#amFkZS50YXlsb3JAYWN1cmlzLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96a3e9758,0x7ff96a3e9768,0x7ff96a3e97782⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:22⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:82⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:82⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:12⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:12⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:82⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1948,i,16214783757506750131,17568545690084340962,131072 /prefetch:82⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD517de8025e7ed477a974c7799d937108a
SHA1ae4aadcaabc26f8ecb7688d5fa3cea1ddedf5660
SHA2564608605e518f1643843b171a01f1654025bc794bbb45e3398904533eaafdb6af
SHA512a81c266acf2524489cb76755585b1780137daa0d83472b4e010193726c77035a398174d207696528a06db9c68c5b241639dfe9c7709326d51c8bea815ab83401
-
Filesize
6KB
MD5cf580a296be8a407e59cfb3fe2353314
SHA1144a50f7ceaa01033f71af171db413f588c45b03
SHA2567dc5da81431ce697126dd481520e6822be34d367b546fb4f50bb8a7f5256a7af
SHA51231997f0337c4592f25bef58fea02758eea1e7afccc17c9b913b2007f0fb4d71ed6626f0c047fd62735f32dd2f64b4ba2f1bb5d68ed54de61d48f02f96dc6b457
-
Filesize
109KB
MD578b63bc97c31bd7d503a252632b8de47
SHA1f701221839980fac1641681966d50a8baf50730f
SHA256b5a7ca8a555b174284739134a9fb52dacd9f0335a0bbc359da782f2f0aa94907
SHA5123ff8c9574ef4db9ffca9137318569d552d8dc881f58ea739c0140381990500d4dff780ba51d2367a1da2b654b0a750b79e725d178d7237d6472f2fc94bbaeb53
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd