Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 08:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://techupd.dynamicssconsulting.com/unsubscribeConfirm/1037833/e3a590dad160a0d395b288b1020b70fa94bf3c5a53120a16245858c1861db876/987564053
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://techupd.dynamicssconsulting.com/unsubscribeConfirm/1037833/e3a590dad160a0d395b288b1020b70fa94bf3c5a53120a16245858c1861db876/987564053
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://techupd.dynamicssconsulting.com/unsubscribeConfirm/1037833/e3a590dad160a0d395b288b1020b70fa94bf3c5a53120a16245858c1861db876/987564053
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133509890709619948" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 264 chrome.exe 264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe Token: SeShutdownPrivilege 4512 chrome.exe Token: SeCreatePagefilePrivilege 4512 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 2580 4512 chrome.exe 85 PID 4512 wrote to memory of 2580 4512 chrome.exe 85 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 1216 4512 chrome.exe 87 PID 4512 wrote to memory of 2740 4512 chrome.exe 89 PID 4512 wrote to memory of 2740 4512 chrome.exe 89 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88 PID 4512 wrote to memory of 4936 4512 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://techupd.dynamicssconsulting.com/unsubscribeConfirm/1037833/e3a590dad160a0d395b288b1020b70fa94bf3c5a53120a16245858c1861db876/9875640531⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69829758,0x7ffe69829768,0x7ffe698297782⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=312 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:22⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:82⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:82⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:12⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 --field-trial-handle=1884,i,16397392075331735758,5321456219889962660,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:264
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD549846f4e582132154b554de6de8d18dc
SHA1e2e35c5d366d3e8ec52de5eb3c7e8573563881ed
SHA2569bdaf6dd7493b09a2f4f64cc2673c0cfba918702d254c7100721467dc3fab06a
SHA512463c6aaae87e568d47498d4eaca5f54f836adc6d886a65abaa833afce6aa905659c6937d345eac371362408d43967223baab29fff7a3446d23931ac8e1df7505
-
Filesize
6KB
MD5fbc55ea4fd057fd1df7cebabc36f7e86
SHA18ed8fb8af1db5695d4fa5ab4a7ede866be554735
SHA25699c2d5f04df681378b3cf0917b17988b1c00b99ea93defd72c181969cc46a00a
SHA512061fba967c8482367cabe12cf63d43319dc5bfb6fb05af995f7967c9ffabc701900cd7719257cdac8e5ad2dcf0f4fbb25aed670130aa14214e678ab93e92e12d
-
Filesize
114KB
MD5e23617caa0c44e1d0692b871e0495b71
SHA1689e81f2dbbf5b7662a606c00b29877d145b1dae
SHA2562dc5d888ac4e1f51a93d579c225074889648cfbc152dbb8e744a1bb8cca6670e
SHA5129c37e574f33e76d1da6a81aaa8836bf5e535211131d5cd2d2647ba37eb6c06aaad8e6fe7f8f456b671c7327a0d297ef716c9fb4d341a954efcb4b4512f736db7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd