Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 14:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://healthfirst.zoom.us/webinar/register/WN_B0h0s7MtR16WIjxyj84ZTA
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://healthfirst.zoom.us/webinar/register/WN_B0h0s7MtR16WIjxyj84ZTA
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133446192165207284" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe Token: SeShutdownPrivilege 4640 chrome.exe Token: SeCreatePagefilePrivilege 4640 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe 4640 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 404 4640 chrome.exe 86 PID 4640 wrote to memory of 404 4640 chrome.exe 86 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 3308 4640 chrome.exe 88 PID 4640 wrote to memory of 1708 4640 chrome.exe 89 PID 4640 wrote to memory of 1708 4640 chrome.exe 89 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90 PID 4640 wrote to memory of 3568 4640 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://healthfirst.zoom.us/webinar/register/WN_B0h0s7MtR16WIjxyj84ZTA1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfaf69758,0x7ffcfaf69768,0x7ffcfaf697782⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:22⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:82⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:82⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:12⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:12⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:82⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1876,i,13358667064910270296,1698198744004998256,131072 /prefetch:82⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456B
MD509348335f0658b0500c1254307255a31
SHA1876e1e341208de9118abcfe14ccc9012fef66186
SHA2566d35c959bad7205427fc1f8635a86bc60b2ef9bf0156d64b3c74cc12b09a3174
SHA512744417eca2b9602efba936626d88528798734e15355a064638b5e9eeff6045f305619c6159a949bc50b27ea752fe3870cdad9b5e9dfdadad66e3dee5c3e2d466
-
Filesize
1KB
MD5902ca1148561d2ca40cddcd66309caad
SHA1a345bacd71003838da7a40e379d6de7bd86f83ca
SHA256ae5da41b5eeb94c85c7f4cc5394906f56f914f6cbc90d2ce01dd2904c770bf9e
SHA512f9cae7b87ecc9181718ae680a4ae3fa58882745ca30a5419a3dd362dd4f92aeb6a15e65a35a59d1c2645c24926dfab6d19c81844dfa1b8a9639fbe16e070f5f0
-
Filesize
2KB
MD587bf5e15f30a4230cd8c80f9a6d67979
SHA1384030df006147544c39f371b86d3e028e60de8e
SHA256db6d5ec209907cb9909e8916a6934b62aae078b42afba966a7dd05d642e99b7f
SHA5128235cae8776653aa0ed48e233f545a1f00e25008ec964bec3c4b479d845cdc7a27b4e387be39478edf2d890aa46e4a809d2d7d89e33f5b5c7751a32ff4baf46a
-
Filesize
6KB
MD58b8303be0ca6b1094dce6e6547640a54
SHA1f26e7ffc74bc0f4cca96c164a8f90fddcec33ffa
SHA2563fa5d7638ad51fbc1e9bbf5393f4c09cdcd7514aae2fd959cc11b2af088f5045
SHA5125f0fc8c1aa57dbcf1c5d967801e5bbf465a0921ba3632db2cb43d6af46bc438a7e5f403e9beeaf510e5b525e866b1503286237e7892fb6022bf87a3ef5419ad5
-
Filesize
109KB
MD5b2cad57bbe785b66f89c6266dd211d8f
SHA12948b6070e3dee05f010a9d9cb84ff332a1c4e30
SHA2566a2621fc1c88dc3f5de56445e6b75cf3544ca677582233fa9b8c0c2b6c660c81
SHA512dabd2825afcff1f5be178a15747d74ab7bd8f6bcb7cddd791474ee617143dfa3a422b34d788bb6f783d16594625a3110122b561cedf65f842be183e3e95b0efd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd