Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 21:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.zixcorp.com/info/zixmail_ZMC
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://www.zixcorp.com/info/zixmail_ZMC
Resource
win10v2004-20231215-en
General
-
Target
http://www.zixcorp.com/info/zixmail_ZMC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506928851691474" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 932 chrome.exe 932 chrome.exe 1688 chrome.exe 1688 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe Token: SeShutdownPrivilege 932 chrome.exe Token: SeCreatePagefilePrivilege 932 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe 932 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 932 wrote to memory of 4296 932 chrome.exe 86 PID 932 wrote to memory of 4296 932 chrome.exe 86 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3504 932 chrome.exe 90 PID 932 wrote to memory of 3724 932 chrome.exe 89 PID 932 wrote to memory of 3724 932 chrome.exe 89 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93 PID 932 wrote to memory of 4192 932 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.zixcorp.com/info/zixmail_ZMC1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb23a79758,0x7ffb23a79768,0x7ffb23a797782⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:82⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:22⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:12⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4868 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:12⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5008 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:12⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:82⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 --field-trial-handle=1868,i,8625170133276327014,13242244965970880965,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD595ba8055c4522d807510d0cac1ee74b1
SHA1592e6c79e22b9f63ab242a5940ca1127e9e26ec0
SHA2566ce4fccf0201eb087e7d74fca3b540ceca8a4f24032f57b51c5f9d891506ac6f
SHA5121c336e122639a0e16c2a0d0741bb4c4a116fcafa20135777550a0bec29584eaebf38346cdc1e8e8dba42c309a44ec737fa4a9321b35c953c60d742ad01387d66
-
Filesize
384B
MD5a6ff63ca0f5839470de76fad5f3a35bd
SHA1d2bce9223315718c2caf6a77eac06431a11c884c
SHA256aeedd61db611c5abcf380418ae5d8b965393fc83a27a7b66d65b4b9d86278dbc
SHA51295993870e67e7d2b10143cd0a45e47b671953cb3267e1fea3851722381eae2c03e69d6f05a885864e346e4d513e637707623a5feadaceae5d4d88195629bd272
-
Filesize
1KB
MD5c8fa8bfa97aeb2ec0ce29e939a384846
SHA1a5df963b5777f9fcbf4f338f825ffd5f5baf6ade
SHA256acc2820cfdf050c506803888a8a8b97a01a01172328cb7a35179f9acb9ed6170
SHA51274d1310a82e3777e46dc87cba08c2688d0c9cc4f69723b22a6353565210a96a1bc28848f6c82ef1483a3b0bc91374f662fbf166137ade0c9c422cb66ea6f632c
-
Filesize
1KB
MD5af950a7280191b966fc550c01b329c66
SHA19b5bec4fb2a96bb979567ae19e62cde3c0c4413b
SHA256772081bacfe00ca2a90226b32c3c6c874511ffcefe0c9c0271671fcad185fb0f
SHA512eb0692de8b52b72c041129efb5094bda600b5700e43e5be92d7614faef5fa17a17d8cf8f0a25af02947e6c7ef191fa5a787182d6ea35617c376c014868518dfe
-
Filesize
6KB
MD558fcfade1b5123a1968181aded488ea5
SHA17b6cd8a67604ced7ef8f851219aa2f905cbbf170
SHA2567e7aa2a52b258aa601b94036b6ec30f630dd6a0ecbafa78aeef10539eb115df4
SHA5129668b3f60da041efab721618936316ac10e77ebae770932df406e05e3ed0cca17bb818a80a902aca7865e266a5587323bd0c792d8a3e87a0c40cb70dadd1782f
-
Filesize
114KB
MD5ef11ae65d84c21969978d65a71d95911
SHA1ce3bdba402ebf43b670261f3e6d0fd68baa62149
SHA256dee9d3a4d8179a190d751b06f35801a3e4ea7234f89c10545e4f0606d2c7945a
SHA5123dc82c2b471ba09159973db6e9b17235993c7fd929d3380f984ac60fb75c1f51763041f72681e29ce0dd359bfe6c6bc1e588748cd812377c90c379ea2cd0a3e6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd