Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 23:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://protect-us.mimecast.com/s/qQ_4CgJVY2Hl5v92ztNZ_XZ
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://protect-us.mimecast.com/s/qQ_4CgJVY2Hl5v92ztNZ_XZ
Resource
win10v2004-20231215-en
General
-
Target
https://protect-us.mimecast.com/s/qQ_4CgJVY2Hl5v92ztNZ_XZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507855823624537" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3108 chrome.exe 3108 chrome.exe 4908 chrome.exe 4908 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3108 chrome.exe 3108 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe Token: SeShutdownPrivilege 3108 chrome.exe Token: SeCreatePagefilePrivilege 3108 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe 3108 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3108 wrote to memory of 4072 3108 chrome.exe 85 PID 3108 wrote to memory of 4072 3108 chrome.exe 85 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 748 3108 chrome.exe 88 PID 3108 wrote to memory of 1176 3108 chrome.exe 90 PID 3108 wrote to memory of 1176 3108 chrome.exe 90 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89 PID 3108 wrote to memory of 2428 3108 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect-us.mimecast.com/s/qQ_4CgJVY2Hl5v92ztNZ_XZ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb57a19758,0x7ffb57a19768,0x7ffb57a197782⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:22⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:82⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:12⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2776 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:82⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 --field-trial-handle=1804,i,16232684193498872590,16596112625643579054,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD57cb2f961599a9746d986b5b48c45ef06
SHA167125330ea1e44ebb8f78c783446f7d99be327f2
SHA2564b7fbb49e572f6bcfade670f72ea882a001c28d17294123c7e4118b83b2e8bd1
SHA512a4dabda4d4cab1fd35548895cd48f8156233d33b9420a53c801eb0ae76fe62355e71f15475d02fb9943a268395dae47c12746e88b4fab5f322bc990b02710846
-
Filesize
2KB
MD5f797488543c841be459fefc2bed2a542
SHA1a1bc71fd775b8ab6ba2def501cd7a780328489ec
SHA256ac9729fade0155432131ee9bebe0cae1f04a3abcd15782a9fa537c7356920e74
SHA5124512808baa726fc87404545506650a9a940abb0fbe5ba15173ba4353e3fa1ddd61bc873c0a6e25f3fe6d313ab3f64f082d7658c9c0ed9aa17641d693e9a5c12c
-
Filesize
1KB
MD50ac5d9806cc00a4cde15cc358d6b040f
SHA1947311d8debadbf37b27c96bc551f5860efcab25
SHA2561cc888fd046522b1775fb4c4074d8ccd86127860d6d2a42f6de87757638f71e7
SHA512ac36a5c0d703c3b80b1f56739f83c99fd441ca8ce2a3173360c385f0e4240c65328c4d7381299134387bac6a9075978bda5e8552babedbf056fd2d0045c28f54
-
Filesize
6KB
MD52ec1acdb6aba3a9dd68281917c9b0f85
SHA17f501904778eeec082bf983edf55280f3da213bb
SHA2567fc00e6e66acbf078380b8a55c7b0314954522d14274e2cbd085be1be9442542
SHA51292a685e31d82739d724832e816f054dee4d707d359a2faa0e06c06497b88b75e96a5b9b552956eb45f92e12b7154374979cc2d0d100bc065cefee6635065fb72
-
Filesize
114KB
MD507e946b04f3a6394bdcac502161c8dc4
SHA189f1651040aef184a998e8e9907cf6df30a46964
SHA25614136ceee54564bb02a8468699d158b9a388c0eecc5a662c291645a83270efb2
SHA512906fc4e758861e8be6a093301a2058b571c1b0904ccaca317497f2b13aae095d8d588493ee391bbf22f1decd831dfc57b32ccfc6f53fc0803baba6c3a3b300fb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd