Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 07:46
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ozmailer.com/oele/downLoad.php?fileNo=2526092&mail_no=13441867&[email protected]
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://www.ozmailer.com/oele/downLoad.php?fileNo=2526092&mail_no=13441867&[email protected]
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://www.ozmailer.com/oele/downLoad.php?fileNo=2526092&mail_no=13441867&[email protected]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504696221662860" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 5096 1900 chrome.exe 88 PID 1900 wrote to memory of 5096 1900 chrome.exe 88 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2544 1900 chrome.exe 91 PID 1900 wrote to memory of 2860 1900 chrome.exe 93 PID 1900 wrote to memory of 2860 1900 chrome.exe 93 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92 PID 1900 wrote to memory of 2116 1900 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ozmailer.com/oele/downLoad.php?fileNo=2526092&mail_no=13441867&[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffeccb99758,0x7ffeccb99768,0x7ffeccb997782⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:22⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:82⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:12⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:82⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:82⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3792 --field-trial-handle=1888,i,16727800007998104872,7918900124228741012,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56d28f80f99f92a003218cbf9b7052661
SHA107059e3e16612c1099b0167d9c1b84e20c31ffb4
SHA256c9cdb5f3d9bcb25de1d0696ff3ec84f08caefa75f8b13c6b9cd61fc6e1695541
SHA512ca65866c9b8b2f7ca4e612fdab6925f6eb254feb9005a2464c6899abb831003b53160d43bd279abbe7744aae3a1e3ce3f47f958d56d1418ef608ae161726e0b1
-
Filesize
5KB
MD510071de55c2fe4836cc460df31fe4c1c
SHA10ac4437efd7a9a33e00c9c1abd2ffdcdafba5543
SHA2560b6852764e47ff7278c0c5985cdabeb37af91ff0de44e1e9d1ea506d0d7a49cf
SHA5127e6a1e69978db9f53e84752d62946c7513665d329cb94cb2a370419d57627eae096b9d7fb3a6466b0c47741a3a5d88b173206e5c35105745f23a27782a9f1acc
-
Filesize
5KB
MD56e3ba4fdf952a9d8d5b104275cab792f
SHA1cfe6b56d91707def22305bd39fcca877136bf6d3
SHA256e8ff56199c61458d49f7982164abab74e27e343bc320eb85e4a5280f8cf7870f
SHA512cabbd9e6a76331f3f04358ee2805837fc768b6221049d5dd024e8dd0604a83fca82a8f202db21c67e46e9fb260bb99e1f833802685cab37f98c110258068ae8b
-
Filesize
5KB
MD5bc4293f2a8c3e67595194c5caf636fd5
SHA16dae665c213de5ac41e1ebcf94e041e5d0568a22
SHA2560798ad69ba5370aa6d7ea71a43fabab603cdd66e09a06a1dbf733278773a2220
SHA51249ae850003efb5b41825018d1b05e6c39ce1c59932c1c2285022bc1f6abe06834c8bd8f6e186974002a6638d6d2d6a79a3d0bf44ba96dc8d6a00b9900a093fd0
-
Filesize
114KB
MD5201b4418704afc6e07ea7cd50250d8d8
SHA1419f9dc3327a5f36ce592dc943d4daff6501f41f
SHA256a8372979bd60accb988d417968fa13bd210d717f65289f4a9cc02a0e8550053e
SHA512b0c88a09d2c9fae94669dc7d444bbe974ede263ec93add97ef4afe59643accb637acfc84d8fb358b9d67b12b4d820b02ff2ce1c99bf42010de758943e5ca8560
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd