Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2024, 05:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://url.au.m.mimecastprotect.com/s/MRsdC71RV5cmZYEKikqa8u?domain=click.e.atlassian.com
Resource
win11-20240221-en
General
-
Target
https://url.au.m.mimecastprotect.com/s/MRsdC71RV5cmZYEKikqa8u?domain=click.e.atlassian.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133547828207530749" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 4980 chrome.exe 4980 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeCreatePagefilePrivilege 1972 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2156 1972 chrome.exe 80 PID 1972 wrote to memory of 2156 1972 chrome.exe 80 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1480 1972 chrome.exe 82 PID 1972 wrote to memory of 1936 1972 chrome.exe 83 PID 1972 wrote to memory of 1936 1972 chrome.exe 83 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84 PID 1972 wrote to memory of 3892 1972 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.au.m.mimecastprotect.com/s/MRsdC71RV5cmZYEKikqa8u?domain=click.e.atlassian.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff938269758,0x7ff938269768,0x7ff9382697782⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:22⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:82⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:82⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:12⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:12⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4968 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:82⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4552 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:12⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3756 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:12⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3464 --field-trial-handle=1812,i,5102853026288077579,1162260401982431371,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5c745f8fe03e7f9402b87bd968c026f87
SHA1a881594a66daf8f4433bbfeedcb85c05f76bac79
SHA256b678d326cd9aee689c81da613623caa206081475eed286470ceb2cff5bddcb93
SHA51210f8910dc28fb26491bf6f043e48032d5f7eb5f522910ca3a230faaacc66767cd68296c2eaeca273379d08e377bdc3116fb88e0eeaac894cf13c97d5f00a5416
-
Filesize
1KB
MD5425532f91e3e187977f9ee4a105dcf51
SHA1b246226adbeaf16feaed458dd8bf783223703098
SHA2562cc3c3778822f200f5a82fa77c6dd747f76a40b2c99694122c75471c70778050
SHA512cb655a4f3e283207dd9db1b427ab01b6eb5fa8968351901c7481186741f6798d311c0558c6e090bc163936a536b67b68830ad0d0d32e8e3f75de707e9c4d22f7
-
Filesize
1KB
MD595810f13312629847ac5c09ec6aac040
SHA1f7edde5c7f9891916dbd97d6bb2997484a78f77d
SHA256e6ea1d47a0c160bda52befa8f490bc9802d755a6af8a712a1c3523a3aab9d2ba
SHA512effbc3f0f704b509116ce66078392bb50743f9e02796889feae94c8872b2b82a7b1c559b71162c1333e15ebcfedfe363f6c30719f446b6f4c541fa5cfee42392
-
Filesize
872B
MD509961a9e2a04be8e7cac8922ed5c644c
SHA127dcac8afe1bea23a60865522179d146ba4d9f9a
SHA2563f68d8e343667576cbf5f8bf84f1e2ec85681647c729d28523c0bcaedfa0b237
SHA512fc3210bdca642c68d5f4f62281d3c5ffc2b9eb551ddb9203969125a5363c8991b02213a4c1d97873f32d4b2ec87702dd6e390d59285a3fd3a33ec4f8b15e3a07
-
Filesize
6KB
MD5fc3b7d2ffc133a77533944a16a447e95
SHA16745a74bbcafff9f291f93c59742a7afd215e4b9
SHA256c570df483178816f27845314e0114f845212207036d304a6d786f561ef176463
SHA5129b5afe3296498ddfe563ccaf563d68cb7cd8c2e26748ec3ff5c069c85a5286d6d6223da0dbea870667ff086c9b53be4de441d49d9edaffb34ce506524ca70a4b
-
Filesize
6KB
MD58e8574ab7a48f1f7a4bd22f7f121030e
SHA10bcccd77a296f5a9a0cce6a779e130060569863b
SHA256162cf2d86f808cd636318e3af4b1106efba1ef7271f62b3a195ae2fe87070af0
SHA51257c52c58c467d871f0866aea00bacbccef5fdd9c22843586d9f7f9be4b67d827cbd094108bfd66ef8d2158d01ae9c576e7e94c1965ca4862281fa6427150019e
-
Filesize
130KB
MD50ffff8c76c2d620abec57380757c8729
SHA187998572290b93f472b80154366806355c7e4e6c
SHA256127cbae46f4713f8705153d89401c1e217dc5dec1369574fbcb08e3d659d743b
SHA512bc0739c7f210b2b6c8cdf6bd451fc9562b22be62bbfe8f028afb60cb4ca3965c72b14dd08e57704d5c92b75ac3aeef9e84556894fb5792ac0cb5c779ac529884
-
Filesize
130KB
MD5b1f67c934cb3a859571ef4804d28c4f2
SHA117d2f30b45052ec545d0639964a7fc15b9839b00
SHA256b03ac6661c577d018b27b4965f114302c713bfc2b22efd2c4adb01106e17118d
SHA51255556ea727f43d9b13df3b6fe1b0ab0dfa0e654b70d398051fc34664cdcb65bdf014f10fb64161699ece5f2304c041eb0d6c8d1a353c326af9d2f50882975b19
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd