Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 19:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://encrypt.greatdentalplans.com/securereader/help.jsf?lang=enus
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://encrypt.greatdentalplans.com/securereader/help.jsf?lang=enus
Resource
win10v2004-20231222-en
General
-
Target
https://encrypt.greatdentalplans.com/securereader/help.jsf?lang=enus
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133512881468851426" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4948 chrome.exe 4948 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4948 chrome.exe 4948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe Token: SeShutdownPrivilege 4948 chrome.exe Token: SeCreatePagefilePrivilege 4948 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe 4948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 1156 4948 chrome.exe 86 PID 4948 wrote to memory of 1156 4948 chrome.exe 86 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 1948 4948 chrome.exe 89 PID 4948 wrote to memory of 60 4948 chrome.exe 93 PID 4948 wrote to memory of 60 4948 chrome.exe 93 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90 PID 4948 wrote to memory of 3152 4948 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://encrypt.greatdentalplans.com/securereader/help.jsf?lang=enus1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac2539758,0x7ffac2539768,0x7ffac25397782⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:22⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:82⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:12⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:12⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:82⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:82⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:82⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 --field-trial-handle=1876,i,9323457276898222588,884554865231534448,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5815a468b0289be87256f2bf29c07e237
SHA1cd45a9b086c79cd452ce851ba9fa0ce4b793c1ae
SHA25668b8947e15506edfe8ae9612ac73420e5d8e77e9554c969ad4f2ca7f1219d489
SHA5125af35f223dddc0bbc2e22b9c0b42f552a38daae8bee47e7e05a7ff31db607b6c3fa81de3552fc0caf80e09931d133fa81032ec263aa76069e4f7f84badc7ee71
-
Filesize
824B
MD580c516fd7f49341d49842486b0c864f8
SHA1ea03b61ecfd1c1c9ab0df3136f085e746abf3eb5
SHA256cfd904751d15b3a03052d75bd5b1360859c90791110e611a30e3f338c8c158cb
SHA512b5aba15cf6134ad503dc58f7e4982c4d027d43290c0bcf0af3a8819dcd6bffb1ef78c1e651378be5e4356d03699bfabc161b54157350bdae94e3562d7e032071
-
Filesize
1KB
MD55256fe43bd15ed88a257914bab011ca0
SHA1021a09be77f8cf0da0fec0d30cb6c613cd1fce3e
SHA25660ade335145f72fc770703b834d08761e4dbd6cf9924fd9ce0f896408e4f02ba
SHA512121a88cf01018561087162bb611c57fc5be873c036e223560876ed99e86d607dfd7670b6b649c953c3aec50363714d5ab5bf682e03879173b57557b5c50a9b5a
-
Filesize
538B
MD59a6555e8d585faf867979e34b6e2fc65
SHA16e52c8c372a7a4fab65e9363993047e6b6c12638
SHA256d3c75a097ef3705098bd3224e52950d0fd744f4818ff71a8b8cf25ce91db7baf
SHA512ee3e29bdbe7438744d7d7f63e013136a7cfcf0f68f8ed453514a74864dd2acbafc7ed7e07409e4145b29947918d9af7e35df44d554d3181a81200edb8a544f2e
-
Filesize
6KB
MD5e88f57bd0feda8e19777938de93cea73
SHA13e3e718505ba04b9198b5509e2532dd8c3bda933
SHA2562c10e94f1f67e2764da14bfbd0464a1a1510cd5cd41cfe00c9db355d51b3bbe1
SHA5126af239b50f89711c8f23be608e7b1bc74ff8c5c925250ecdc682d32ab98743a9c5ab83df7b950bdb3b69797e9a0c522d2eb2827c92e8f93046403142318108b1
-
Filesize
6KB
MD537c43fe7af202da61f4b666e9ec622d1
SHA1d5e28dd5d47e939634ab4e76dd54f66b8da407f9
SHA2565da83a80d6812ee99b8641cf8dee92b6c13d1dce3f152d5c24ba5b696ea7d74d
SHA512d3c082fb9f6064829b06b5e328d279f09abde8faf84eb476a56b0cddf18aa9966a64f54807c79edc43543c269be8628119634de68b5f5675c4731e0892eaed0c
-
Filesize
114KB
MD565798bbc701c75c96d3731f289d66fa6
SHA1aa048bce9ba02de4b884aeaccb98e20404240a28
SHA256aaf959ed1e6ce35e1072bb8e1179f0348453e12bcd3847136a673572a704e700
SHA512b6aec35558cc993738d9d765822e9e7c7225ec86d9b0120de9bb8f0f06c43a6e0cd5ad86f6779b3abc04ed9bb5cb756b41d33344807d0fe711560301f18372e4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd