Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 03:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nyc3.digitaloceanspaces.com/lumat-prod/static/accounts/img/new_user_email_background-mobile.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=PRIPT7F66GHPZ7HBKWM5%2F20231228%2Fnyc3%2Fs3%2Faws4_request&X-Amz-Date=20231228T225859Z&X-Amz-Expires=7200&X-Amz-SignedHeaders=host&X-Amz-Signature=a6f2255c6afc1ffe8abead94e7ed03768814b826d3bbfd98b99d0d38ef9904c9
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://nyc3.digitaloceanspaces.com/lumat-prod/static/accounts/img/new_user_email_background-mobile.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=PRIPT7F66GHPZ7HBKWM5%2F20231228%2Fnyc3%2Fs3%2Faws4_request&X-Amz-Date=20231228T225859Z&X-Amz-Expires=7200&X-Amz-SignedHeaders=host&X-Amz-Signature=a6f2255c6afc1ffe8abead94e7ed03768814b826d3bbfd98b99d0d38ef9904c9
Resource
win10v2004-20231215-en
General
-
Target
https://nyc3.digitaloceanspaces.com/lumat-prod/static/accounts/img/new_user_email_background-mobile.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=PRIPT7F66GHPZ7HBKWM5%2F20231228%2Fnyc3%2Fs3%2Faws4_request&X-Amz-Date=20231228T225859Z&X-Amz-Expires=7200&X-Amz-SignedHeaders=host&X-Amz-Signature=a6f2255c6afc1ffe8abead94e7ed03768814b826d3bbfd98b99d0d38ef9904c9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133482942888918316" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4984 chrome.exe 4984 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 4308 4564 chrome.exe 88 PID 4564 wrote to memory of 4308 4564 chrome.exe 88 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 3812 4564 chrome.exe 92 PID 4564 wrote to memory of 2460 4564 chrome.exe 91 PID 4564 wrote to memory of 2460 4564 chrome.exe 91 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93 PID 4564 wrote to memory of 4872 4564 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nyc3.digitaloceanspaces.com/lumat-prod/static/accounts/img/new_user_email_background-mobile.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=PRIPT7F66GHPZ7HBKWM5%2F20231228%2Fnyc3%2Fs3%2Faws4_request&X-Amz-Date=20231228T225859Z&X-Amz-Expires=7200&X-Amz-SignedHeaders=host&X-Amz-Signature=a6f2255c6afc1ffe8abead94e7ed03768814b826d3bbfd98b99d0d38ef9904c91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e38a9758,0x7ff9e38a9768,0x7ff9e38a97782⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:82⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:22⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:12⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:12⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:82⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:82⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=820 --field-trial-handle=1892,i,162322600946233577,4327288603454241887,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a00c6f3ab93c9261f0e0594e2ee3b4d7
SHA19eece8d97c4fb8616ac3e9219ab10ae1af89b205
SHA256a6e17c6544012433b080e5400cb8b4448ef70116bdb5ca2d9e3748327f39a8e9
SHA512b0dd9d908048162435096d76935d3a2ff523ee22d1b42fcc21e5774bec8e6fcb4ee210ae51f8ab0fbba5bd3484aea6c8a8dac21a6386cb18b96a535769fb7715
-
Filesize
538B
MD5627effbf0aa5594f0f41f4c652f95d43
SHA1f85291e39987941082b812b388c8b9156dd0b371
SHA256c685c1dea873eb696f4d2126927120e0fe48c8a23e5501bd17df3acca72348d1
SHA51235068d2bdf54d983e8cb4170e7e95d8a5ba5add203cb908ef988c1f88670c863e74843ed2da0f997ea583e35f77f5b902b7d1a8d52e5ce2c94af0a28e4e8337d
-
Filesize
6KB
MD516d39ec1e2cb4c8f091ee55e1056d9fc
SHA10d345d9ffd176aa8bc3e56c5b311fca7b50152c0
SHA256b6e8a927dc06d6927218507437f170d26d445ff4f0582e365034e018aa0164da
SHA512980adbf380f53ef221a272e5cab42306ab4209d4201a6f6c5d5c86643081d4c1d1430508b652aedd039f178968a2ca45539f6e522ef481ab195a447cc8ba8cf8
-
Filesize
114KB
MD5aa71fafba27da2014969d639088f3c42
SHA102d6c54ae6bb2125a791b7adceee163a6f6c7454
SHA256b0ea30a385f9b2628d868827d57970eb7317e3c0860604451b05f999ef326c0a
SHA512e89b8aa2de9a10725a2974a73739027601465c62043104d9f7eab21839d8c526db2318cf1c39dcda8ddc90b2d2f4d48d1466f64c69f57ac55f19fb88477ee552
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd