Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2024, 18:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://protect-us.mimecast.com/s/17e3CxkNq1sJKlOq0c8_3J9
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://protect-us.mimecast.com/s/17e3CxkNq1sJKlOq0c8_3J9
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://protect-us.mimecast.com/s/17e3CxkNq1sJKlOq0c8_3J9
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133499906489016586" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 1572 chrome.exe 1572 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3864 4852 chrome.exe 84 PID 4852 wrote to memory of 3864 4852 chrome.exe 84 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 2208 4852 chrome.exe 91 PID 4852 wrote to memory of 232 4852 chrome.exe 90 PID 4852 wrote to memory of 232 4852 chrome.exe 90 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92 PID 4852 wrote to memory of 2356 4852 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect-us.mimecast.com/s/17e3CxkNq1sJKlOq0c8_3J91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb48a09758,0x7ffb48a09768,0x7ffb48a097782⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:82⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:22⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:82⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:12⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:82⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 --field-trial-handle=1972,i,17012039057071699218,3247490850309157157,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672B
MD5595a8d9a5c5628d3bfaecbde669a6d22
SHA18969d941a244bdc6501bc1f7a01f1da42d44a0a8
SHA2564a96540fab1d98fbc9db37c77a0dc5f01202cac337d56c229e0ea10b9bbfa42e
SHA512e2f61cb5bc73863ffd776a51a3173d89d9028567d77e6e1491baa32984cd747b480b00a0be703420ec51e298d1f62411d88d74f26f8b70c7c0ea81392bb1de31
-
Filesize
2KB
MD5c838f5c6aa82e52078c9fc1de983d628
SHA1cc86f36fb7dc9db95172bf86713f7c51888e1f85
SHA256fce415452695350cfbb78c80d3df07e609d4b42972dc091590e4bc18ae3ade0b
SHA5120403ab6c51a3852a5e5eefd250499335cbb56f2c69060fc61845f9354086a52ff436d33b256bc9d077516bb5289936a38daba00f58f94a8190f0e14fa1c34560
-
Filesize
1KB
MD5dd7b2853e43cd7253cf3920cb74262d7
SHA1150ea8653b17dd991ed5c1ccbe7db7796bd2d60e
SHA256f846824a13197f63cffdb3a045ee4f89fcc49eeab80ef12adf8a0dcb636ae1dc
SHA512da5a8ac142d107c15f5bc6fc6f1b2b504062e89aa536ec1dc33ea2619a4ace8aa2f4d5c003496112436771d687feb71fab75227125b78e04b58ac6fa73983e5a
-
Filesize
6KB
MD5a204015dec9eae845018e14c459c4415
SHA1878f15fc8e251203b98fdb2900a3fca796e71d6e
SHA256f64d68262ad1d71080643b03c628caea3b72f0df34101d877cbc1e6350b0266d
SHA512b097a795beea8095307ce05621b204db2c1593e35afda21015bfe9910bb952d47e4ab557903372c2688aaada39bc4173b8fd417251b7fd0a707f0328bf9b0e24
-
Filesize
114KB
MD53e72206785986c41985c0aed1ada6dc1
SHA19f0349f99c3157fdd31fe7580d27a63824f672aa
SHA25634d79d26b91d29f509e38a9b4846d58b8157d108721324d33ee5ac6462fdab11
SHA5121ea67e28a5c418cadab15982886b57e580928c3e57e78af47441b54de5e1e397a52ab805bf2c0357327f021fdb510f658f3481d3bbbb0001851d3b34d4305e0e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd