Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 04:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://links4.upsemail.com/servlet/MailView?ms=NzM4MDA2ODkS1&r=NjY5MTM0Njg1NTQ5S0&j=MjUyMDM3OTU2NwS2&mt=1&rt=0
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://links4.upsemail.com/servlet/MailView?ms=NzM4MDA2ODkS1&r=NjY5MTM0Njg1NTQ5S0&j=MjUyMDM3OTU2NwS2&mt=1&rt=0
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://links4.upsemail.com/servlet/MailView?ms=NzM4MDA2ODkS1&r=NjY5MTM0Njg1NTQ5S0&j=MjUyMDM3OTU2NwS2&mt=1&rt=0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133489887969650073" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 3608 chrome.exe 3608 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 4796 2080 chrome.exe 87 PID 2080 wrote to memory of 4796 2080 chrome.exe 87 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 1852 2080 chrome.exe 91 PID 2080 wrote to memory of 3624 2080 chrome.exe 92 PID 2080 wrote to memory of 3624 2080 chrome.exe 92 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93 PID 2080 wrote to memory of 5012 2080 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links4.upsemail.com/servlet/MailView?ms=NzM4MDA2ODkS1&r=NjY5MTM0Njg1NTQ5S0&j=MjUyMDM3OTU2NwS2&mt=1&rt=01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7e649758,0x7ffd7e649768,0x7ffd7e6497782⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:22⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:82⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:12⤵PID:812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:82⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1712,i,2574212352040088153,3909608571070775087,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ea041b40f504a601c45b1b6c48a5daa3
SHA13b63bd36876f1ce00f9ea3111c4da5d877b3735a
SHA256a7a38a331c23932c238e90fe4e226388f04f6a2469f56e21eaf039e2e3e0a3cc
SHA512af6474eb112740f72a57a4b64ead56e8425569d8acb04a8e7cd18ec80d0aa16ac2715557e2bc152f0692b2cf48e5522ffd716b975f798f854a10d7331a0bf135
-
Filesize
537B
MD5a3bf3eb6c9ecf9bbca3de96bad28b8bf
SHA1fc86ae035fa1bc5dd15d31e7ae11d186124b68a2
SHA256d729a095e74618bd0e29e13dc1c5cdc1101a8ae38ae44adcfae560044364da99
SHA512c43572b1d952dc785244ede98118f67ee5031aca8c8a9c7b402893b77cd45956bb80097ffd321286b6e0fb727faeebb37e95fad43ab4b158481d6c1c159d13c5
-
Filesize
6KB
MD51003c05d2d5235f0ddd028245d4f503e
SHA130400bf99a0049040874b70723ba64e6c84b07d4
SHA256b9ba6a706f9b53c540b0de0daea1a65505edb355a2d611243bfc43f751fd10c5
SHA51267ed9152d2cdaa746382806e431edf3d536aba0d9c040791e4d0d7303b355c63a870f1b96241fddc59d7ba35f5e3ab0dd1e17591fa8db95c2414f026e52be755
-
Filesize
114KB
MD5ac5c9910f7ed9e08f3ca7a9235a647e1
SHA141d8ecce324e73975782c7c81d628de65f62f496
SHA2567e88b6d141bb6d0ba521eaf4c044e30c5fd6c19a6e2e3d79054e5e5f34d9b650
SHA512359738426dca2e91482c5ca4ba30664166d4e8d59af1d8d270dc5d8a364c709d735312392a0f6b27cbae73977fd7e354550c3873d51ad8364b4815fad12cf5cd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd