Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/03/2024, 20:07
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.uk.nespresso.com/r/?id=h859505ee,590c6122,56f60c49&p1=exit66fl.com/asdf/wpfile///esab/[email protected]
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
https://t.uk.nespresso.com/r/?id=h859505ee,590c6122,56f60c49&p1=exit66fl.com/asdf/wpfile///esab/[email protected]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549204597697860" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1988 chrome.exe 1988 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 3188 1228 chrome.exe 80 PID 1228 wrote to memory of 3188 1228 chrome.exe 80 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 4632 1228 chrome.exe 83 PID 1228 wrote to memory of 856 1228 chrome.exe 84 PID 1228 wrote to memory of 856 1228 chrome.exe 84 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85 PID 1228 wrote to memory of 4716 1228 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.uk.nespresso.com/r/?id=h859505ee,590c6122,56f60c49&p1=exit66fl.com/asdf/wpfile///esab/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f38b9758,0x7ff9f38b9768,0x7ff9f38b97782⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:22⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:82⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:82⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:12⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:82⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3272 --field-trial-handle=1800,i,14242508105718896564,5296541306248517617,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c9f6545c4af5726aa43ca57423cc4a8
SHA18150451e845a87088ec7aacfb17c2e6d7d18570c
SHA256b63be04d56c1badec2ec9fbf4853642f27e4d1ceea627e880634d7fee4bbc62c
SHA512729d43a0aabe72e20507a3d57b2a16b8306b0c6dda6cf4004d182ec4d2e1d960f1c6cf643d62e131a85b70d363710c336097ed4851c74158c52f5dc902e4cf14
-
Filesize
6KB
MD50bdc8009084c02811a62ccdac7b0f432
SHA1e5020d70fe40157c8b38ee41a6327f6d1b209662
SHA256bff96942eca5b01dfb183c2f1942ebea7e565cd1c96ea0107cbb5ebb5fdb2457
SHA512f537c9780691c28bf3b83c7faf64f1b8d17ac1d7e81fb5dfd3ed6951de2dac92a3e2c3701289482e2b63364ab0be8dcf4b629ee7cfa36d937ede8ae849159385
-
Filesize
6KB
MD5eb286275db28b8f8590270abee3a62da
SHA16f134546652c401c30d977adeff33c9ab3682b2b
SHA2561188ecc5e69c0c6621b0632579c28f125b8dfef477585605f516800407a260b5
SHA51210ae025b091be9a594c5260ca471bbc2974b1e8677684c03f52d4d08c7f76e287aeecd986abab3945d080df8ce1c0a62253fcb01c48dffb96b5126d25cde685f
-
Filesize
256KB
MD5255c649745d18186d568fc38b84d4f81
SHA1600fef730553c06c819e8039d3007907e011c054
SHA256253b1787658e5779f3a16959f84f34ee41fb18f2660143f1f635634e7e2b48fa
SHA512c4424da791f10435dea90a009d23781d68adfcb2ff104d70a1513a373fddb85a2255ed71c1ea819ae876cffd8af8fdf38a63064df24382e47e8b813fd8c891bd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd