Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 02:02
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pagos.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkY lMkZjbG91ZGZsYXJlLWlwZnMuY29tJTJGaXBmcyUyRmJhZnliZWlj d2hrcmdlYW1lNnh6bWt2dDNscXRtZ20zenZ0M3p2ZHRmYnJzcTdrN2czZW9hdmdpZnQ0JTJGd2 VibmV3d2Vicy5odG1s&sig=GJofBfdk6aL4RAw6SuzuziEeLwUWDBNKxGoajaCbWDe1&iat= 1709817888&a=%7C%7C478518517%7C%7C&account=pagos%2Eactivehosted%2Ecom&email= uYx4v5QsjPQ6kMTk3AC2%2F5TX4eaxE3vwIGVdyNFI%2BCNXoDTnph%2F1PB3iNg%3D%3D%3Aq3C5WQC48RnCOfPqNDaui4fgFx3N8eF7&s=aGFsYS55QGlmYWxzLWludmVzdG1lbnQuY29t&i=2A4A0A11 #[email protected]
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://pagos.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkY lMkZjbG91ZGZsYXJlLWlwZnMuY29tJTJGaXBmcyUyRmJhZnliZWlj d2hrcmdlYW1lNnh6bWt2dDNscXRtZ20zenZ0M3p2ZHRmYnJzcTdrN2czZW9hdmdpZnQ0JTJGd2 VibmV3d2Vicy5odG1s&sig=GJofBfdk6aL4RAw6SuzuziEeLwUWDBNKxGoajaCbWDe1&iat= 1709817888&a=%7C%7C478518517%7C%7C&account=pagos%2Eactivehosted%2Ecom&email= uYx4v5QsjPQ6kMTk3AC2%2F5TX4eaxE3vwIGVdyNFI%2BCNXoDTnph%2F1PB3iNg%3D%3D%3Aq3C5WQC48RnCOfPqNDaui4fgFx3N8eF7&s=aGFsYS55QGlmYWxzLWludmVzdG1lbnQuY29t&i=2A4A0A11 #[email protected]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543369712844014" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 220 chrome.exe 220 chrome.exe 4736 chrome.exe 4736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 220 wrote to memory of 264 220 chrome.exe 87 PID 220 wrote to memory of 264 220 chrome.exe 87 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 1640 220 chrome.exe 89 PID 220 wrote to memory of 2004 220 chrome.exe 90 PID 220 wrote to memory of 2004 220 chrome.exe 90 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91 PID 220 wrote to memory of 2872 220 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pagos.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkY lMkZjbG91ZGZsYXJlLWlwZnMuY29tJTJGaXBmcyUyRmJhZnliZWlj d2hrcmdlYW1lNnh6bWt2dDNscXRtZ20zenZ0M3p2ZHRmYnJzcTdrN2czZW9hdmdpZnQ0JTJGd2 VibmV3d2Vicy5odG1s&sig=GJofBfdk6aL4RAw6SuzuziEeLwUWDBNKxGoajaCbWDe1&iat= 1709817888&a=%7C%7C478518517%7C%7C&account=pagos%2Eactivehosted%2Ecom&email= uYx4v5QsjPQ6kMTk3AC2%2F5TX4eaxE3vwIGVdyNFI%2BCNXoDTnph%2F1PB3iNg%3D%3D%3Aq3C5WQC48RnCOfPqNDaui4fgFx3N8eF7&s=aGFsYS55QGlmYWxzLWludmVzdG1lbnQuY29t&i=2A4A0A11 #[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe089758,0x7ffcfe089768,0x7ffcfe0897782⤵PID:264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:22⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:82⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:82⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:12⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4516 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:12⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:82⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3828 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:12⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4880 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:12⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 --field-trial-handle=1844,i,11611268555427133241,5974768055156322346,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD596bbfbe855084b045d1d3b317ac9045d
SHA113195a5507350f0c1899ef6ea1aac3dd919d4d4f
SHA256f38d6c4e9179553c168190b2609c5e18f472f7df939363618e83fc39620a4075
SHA512829a3ed978b7fad3c7e4413b36190c0ccddd5695c1ae4268cbd76ed4c808648b2932351a44d749c313799c14996c8eabf1eb035bcaf99090c58c2fb70679445a
-
Filesize
6KB
MD5ff1834457ccc44a8e63bcfcac4128fad
SHA15ed296774428e66ef306177505f450ba04e75d99
SHA256379e1d9bafb9c085866ef921b7ca185c1406b2078849fca423074c051d3fa4d7
SHA5123b5014d59243f41600082b1bb96ac52fb3c1ca6533559ee1e9b7594122fa83a2ca1f2dd34a69f0ea9558b5619b7e0b434988cf2e2b7fced4921efcb15d1e1c26
-
Filesize
253KB
MD58669b013cd2aecfe7329e2e86c4046ec
SHA1ef52142aae4601991a09fa537b42f91a8fa8358e
SHA256f21415dbe57880da5be9777c78a514022bbde990cea9a7c55cf66ebc91a705b3
SHA5124e498671ba11bd7c5ac1c06d7225fb1259fb9c7c38c82d388d57b96d581c6fccbcd0865b424e23dca1f94fc9e7fb9206809c29a6bfd87afc9be78a1ee368ed16
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd