Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 16:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://myresman.my.salesforce.com/img/clients/mailapp/t.gif#mid:137ed90a-bda8-4623-ac51-a43cd19c4b3e&uid:0053n000008l9fdAAA&oid:00DE0000000eCyq&what:a6f3n0000000qx0AAA&to:0032R00002Jv0J7QAJ&cc:003E000001aKEoAIAW,003E000000X4ycFIAR,005440000096sihAAA,005440000099EdWAAU&bcc:&ew:0053n000008l9fdAAA&ts:1704300097370&acstId:&fType:&acsId:&eTId:&exId:AAMkADM3NjI3OTg5LTg3ZGQtNGI1ZC04ODAwLWIyNWU0NTJmZWRiNQBGAAAAAACbTj8yhNgDTJX06GCKwwkUBwCxyWvN6gRiTqUTdMu/oYT9AAAAAAEPAACxyWvN6gRiTqUTdMu/oYT9AAAO9DO/AAA=
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://myresman.my.salesforce.com/img/clients/mailapp/t.gif#mid:137ed90a-bda8-4623-ac51-a43cd19c4b3e&uid:0053n000008l9fdAAA&oid:00DE0000000eCyq&what:a6f3n0000000qx0AAA&to:0032R00002Jv0J7QAJ&cc:003E000001aKEoAIAW,003E000000X4ycFIAR,005440000096sihAAA,005440000099EdWAAU&bcc:&ew:0053n000008l9fdAAA&ts:1704300097370&acstId:&fType:&acsId:&eTId:&exId:AAMkADM3NjI3OTg5LTg3ZGQtNGI1ZC04ODAwLWIyNWU0NTJmZWRiNQBGAAAAAACbTj8yhNgDTJX06GCKwwkUBwCxyWvN6gRiTqUTdMu/oYT9AAAAAAEPAACxyWvN6gRiTqUTdMu/oYT9AAAO9DO/AAA=
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://myresman.my.salesforce.com/img/clients/mailapp/t.gif#mid:137ed90a-bda8-4623-ac51-a43cd19c4b3e&uid:0053n000008l9fdAAA&oid:00DE0000000eCyq&what:a6f3n0000000qx0AAA&to:0032R00002Jv0J7QAJ&cc:003E000001aKEoAIAW,003E000000X4ycFIAR,005440000096sihAAA,005440000099EdWAAU&bcc:&ew:0053n000008l9fdAAA&ts:1704300097370&acstId:&fType:&acsId:&eTId:&exId:AAMkADM3NjI3OTg5LTg3ZGQtNGI1ZC04ODAwLWIyNWU0NTJmZWRiNQBGAAAAAACbTj8yhNgDTJX06GCKwwkUBwCxyWvN6gRiTqUTdMu/oYT9AAAAAAEPAACxyWvN6gRiTqUTdMu/oYT9AAAO9DO/AAA=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133493789287810501" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 4888 chrome.exe 4888 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeCreatePagefilePrivilege 1620 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4056 1620 chrome.exe 14 PID 1620 wrote to memory of 4056 1620 chrome.exe 14 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 4284 1620 chrome.exe 31 PID 1620 wrote to memory of 2840 1620 chrome.exe 29 PID 1620 wrote to memory of 2840 1620 chrome.exe 29 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25 PID 1620 wrote to memory of 1068 1620 chrome.exe 25
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd80989758,0x7ffd80989768,0x7ffd809897781⤵PID:4056
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://myresman.my.salesforce.com/img/clients/mailapp/t.gif#mid:137ed90a-bda8-4623-ac51-a43cd19c4b3e&uid:0053n000008l9fdAAA&oid:00DE0000000eCyq&what:a6f3n0000000qx0AAA&to:0032R00002Jv0J7QAJ&cc:003E000001aKEoAIAW,003E000000X4ycFIAR,005440000096sihAAA,005440000099EdWAAU&bcc:&ew:0053n000008l9fdAAA&ts:1704300097370&acstId:&fType:&acsId:&eTId:&exId:AAMkADM3NjI3OTg5LTg3ZGQtNGI1ZC04ODAwLWIyNWU0NTJmZWRiNQBGAAAAAACbTj8yhNgDTJX06GCKwwkUBwCxyWvN6gRiTqUTdMu/oYT9AAAAAAEPAACxyWvN6gRiTqUTdMu/oYT9AAAO9DO/AAA=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:12⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:22⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:82⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:82⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3656 --field-trial-handle=1832,i,5323275648558385704,479054198142743375,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536B
MD570f30937340f66f66f568fd298c7b474
SHA1fffee1eb43c6c96e464b6efea7026a164a333f9c
SHA256d226d89421ab25014e670b7a571bb3987fd19b248610a75d3a74f66ce65cf8c4
SHA51265b3c8f002b6bda7e6587602d6f659902234aceebe62471af4bf6adff7914cc477d49d1f6dce22c03f862be62f03069d9e62e8b9763142a7a91b6fa6ee275922
-
Filesize
6KB
MD593b08325fdce658c86fa1747f480e604
SHA18b45fbd3cf4bfcdd51d09fc0a3a6c1091ef8f930
SHA2562018ea5906239319e274ffcc1f8dd0fedd2c6231514db37d558d7f3e0917e015
SHA512515a493d67e7bad9e27b03a02900ee603694178c2e01c726080cb922447bb6db3a04fbdbcf4f007d0614c861bcf8753f853b99b9c56da6b504588f07f446c902
-
Filesize
114KB
MD56dc863e8cf4b85fdd08ed58a36f3a06b
SHA1b83e85deab319946756a076045a1579f96a56f8d
SHA2560a6820b73842ae7a7ee54d7448c5dd3a00fdef16a6c0f1850fa0cf5286af56e0
SHA51243e683f16c53fb92275381a4bf5e63f38658c953be536ceef2d6f355e0683bbccfd418aa2337c07d10c7766a6d76a90357bf5cb4629621f22bc38143820e7c2d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd