Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
289s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 09:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://link.mail.beehiiv.com/ss/c/u001.vYQ2JzI6Bx1BLFFv3-OVT4QQotD51h6PNew05j4b3PLISVRhgL8iHIIdQbriBf6rqJaTHoaVIdhotvypkc3JXmApGVRlScrDLmx6C5YXdH9mhbFx8cOoPNsc5VgpOdebktlXYCetPTfseF5kl7yPeo_krlXMFDVM1rOSjeYVRNlj9HLXhOFAFp6qxz18pgDy/45p/2MyduNCpS5OEP0XWMEJB9A/h6/h001.irT-r8u22JUHF_mX3SUQioHaoRJO7pHvdrZOgW9TWbg
Resource
win10v2004-20240412-en
General
-
Target
https://link.mail.beehiiv.com/ss/c/u001.vYQ2JzI6Bx1BLFFv3-OVT4QQotD51h6PNew05j4b3PLISVRhgL8iHIIdQbriBf6rqJaTHoaVIdhotvypkc3JXmApGVRlScrDLmx6C5YXdH9mhbFx8cOoPNsc5VgpOdebktlXYCetPTfseF5kl7yPeo_krlXMFDVM1rOSjeYVRNlj9HLXhOFAFp6qxz18pgDy/45p/2MyduNCpS5OEP0XWMEJB9A/h6/h001.irT-r8u22JUHF_mX3SUQioHaoRJO7pHvdrZOgW9TWbg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582505937624509" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2204 2348 chrome.exe 86 PID 2348 wrote to memory of 2204 2348 chrome.exe 86 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 1664 2348 chrome.exe 87 PID 2348 wrote to memory of 2028 2348 chrome.exe 88 PID 2348 wrote to memory of 2028 2348 chrome.exe 88 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89 PID 2348 wrote to memory of 708 2348 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.mail.beehiiv.com/ss/c/u001.vYQ2JzI6Bx1BLFFv3-OVT4QQotD51h6PNew05j4b3PLISVRhgL8iHIIdQbriBf6rqJaTHoaVIdhotvypkc3JXmApGVRlScrDLmx6C5YXdH9mhbFx8cOoPNsc5VgpOdebktlXYCetPTfseF5kl7yPeo_krlXMFDVM1rOSjeYVRNlj9HLXhOFAFp6qxz18pgDy/45p/2MyduNCpS5OEP0XWMEJB9A/h6/h001.irT-r8u22JUHF_mX3SUQioHaoRJO7pHvdrZOgW9TWbg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3e39ab58,0x7ffd3e39ab68,0x7ffd3e39ab782⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:22⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:82⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:82⤵PID:708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:12⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4484 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:82⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=740 --field-trial-handle=1840,i,2587778623246969603,3608580004821522698,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384B
MD56cfacbfe7d031ead68f8774ce127bcc7
SHA1aa1132ba63f7b189514cc1bcea48ef5a8c99e523
SHA256ab93e4aef84baebf83ef70f6be73cf249fd9a119cf1547beb625abf5ee64a950
SHA5125ddfd66b89f013ea26597df2bb0bdb2eee76299e643073a5b0d4f5826ef7c86d7a53936ab8cc60beb0bb5eedbaf36219c7319aa6cde6343c171f4c2a5285c1b3
-
Filesize
5KB
MD5ce1e5eac2251157dbba0bee8fe156a55
SHA16c1c2d156ed3845fd43d32d51b804c8fe49569ed
SHA2565969e1c50854f2231f26ee442bb628c5ab8eae7e45a54902fb2d5198456ed1e4
SHA512f7352fc59cd7455abdae196d071ec0f47819b01b408b51f7154d93e14f20f86732639e63a08cb35c3e712133c1c0848012d15e1fba48c1581437589971c100a2
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD5abfb04eb205185f0279fbd381ccf07f8
SHA11b4fbc6ff7ca4ead43a35a5af0330152c6b74e1f
SHA256da6aafc0ae2eed002fa339c8f7e2881cae16a0fac52ab9d45f4b7af5382d585d
SHA512e586f1b96a85a02834a78da645f2b520bf7dfcd21d7b2a36be8d167001799fe22c3ed1862e6ceaaad692b0ed9ff9ecdf80e02d5bc8b1a91438fd3a003ead030b
-
Filesize
7KB
MD56753b68e02502ae13067f42304a17644
SHA14f9f290b33ad939c621717e396def823252141d5
SHA25696318942cf7b07a2348504674c9a603465e85a0bf3a9ce3f54668e4f5ec5f57b
SHA5123e415993a373fbba78aa4f675797924b232e5ed58f9cab3a3245a641c658b8ed70a9e5c58215ce324161fa74dc471c273c05f4067bb3c0f0d11a6ac78ab8c5ba
-
Filesize
250KB
MD501a9b27ba5ee8f7af2bffffc55ea3bb1
SHA1d04c311443a0c2de0c8a85eed7dc483699cd00c7
SHA2569c8fde1080ad34297fa767a11c655a0f27097111074a081c34cce0136731e9ad
SHA512acac7079c23149885754ef97306f281e11d87ef8ebd56fe928da93cc3671c40a7b231416600bbbffc740c733937edff34bfa843a59b9e0836118a15cf22f02c2