Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 06:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://swissthai.glueup.com/track/rd?type=campaign&lid=3&tracking_id=1468:275153:b62763b1-a253-4721-b4bd-fc415a38a6c7&redirect_url=https%3A%2F%2Fwww.eventcreate.com%2Fe%2Fsustainability-for-business-forum-2024&ts=1715573566&ps=Yy9ndTd3ZE9mTjdENk1sVDVGVzBGajN5ME8yamJtS1hvSklVSEJvczR4Y2VHNmRWK0FYYXpZZnlCb2w5WU9lT2NMZWV
Resource
win10v2004-20240226-en
General
-
Target
https://swissthai.glueup.com/track/rd?type=campaign&lid=3&tracking_id=1468:275153:b62763b1-a253-4721-b4bd-fc415a38a6c7&redirect_url=https%3A%2F%2Fwww.eventcreate.com%2Fe%2Fsustainability-for-business-forum-2024&ts=1715573566&ps=Yy9ndTd3ZE9mTjdENk1sVDVGVzBGajN5ME8yamJtS1hvSklVSEJvczR4Y2VHNmRWK0FYYXpZZnlCb2w5WU9lT2NMZWV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133600539947149982" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1084 chrome.exe 1084 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3192 1900 chrome.exe 92 PID 1900 wrote to memory of 3192 1900 chrome.exe 92 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 3372 1900 chrome.exe 94 PID 1900 wrote to memory of 2520 1900 chrome.exe 95 PID 1900 wrote to memory of 2520 1900 chrome.exe 95 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96 PID 1900 wrote to memory of 2260 1900 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://swissthai.glueup.com/track/rd?type=campaign&lid=3&tracking_id=1468:275153:b62763b1-a253-4721-b4bd-fc415a38a6c7&redirect_url=https%3A%2F%2Fwww.eventcreate.com%2Fe%2Fsustainability-for-business-forum-2024&ts=1715573566&ps=Yy9ndTd3ZE9mTjdENk1sVDVGVzBGajN5ME8yamJtS1hvSklVSEJvczR4Y2VHNmRWK0FYYXpZZnlCb2w5WU9lT2NMZWV1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee7ce9758,0x7ffee7ce9768,0x7ffee7ce97782⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:22⤵PID:3372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:82⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2168 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:12⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:82⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:82⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2360 --field-trial-handle=1892,i,7695035809517521679,9222253222482231474,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
710B
MD5070131f70f827f6ca478d65d54d419c3
SHA1f792c9786fb917bae5c4971160888188884a19a4
SHA2566f866dec553b0c540b94cea367d2867e1786774b112afd5aa66ffea6fcdb22d6
SHA512b2374c498ff6020b32b471c6d90c74a01d939f8a9c3d6d9a7df86a157bece6d6e1be705dd2f17dba5c15eb5aa6a7e1c1fdf972591bba6e059cb176559c1fc647
-
Filesize
986B
MD50b0250f9c18fc81fa697f03609eef213
SHA172faa6aee2e7035f9b553b0e0ff86cd2c82d770c
SHA25641ed25c243f4d8e905b05be81cb6244ff7ce380a900221b061a4910423ef1ff7
SHA512f77fb50fa4e6a6492f425b7b5f2c81854eedefd10124159a11435d1dd3499aa912159ff6ab13cb486ba5070e3473a607baf846d0d82392871d43e9091a20c959
-
Filesize
536B
MD546d36d48be02a3c4392fe5ec0379cc22
SHA15a30bad4d40cfc8de12b1b65651ae4faa9e810ff
SHA256ede09b21f8f555dd98bc5651dd920dfe0f038154e0556d9d74a5e780b913ef4e
SHA51265447552176538df7853c7e9476b40d1eb4ffb758f217bddd0a1c8d66ce48bcaf532b484f35154817e5890d4dc22ca15fc618ac1cac595e8994277f5a408577c
-
Filesize
6KB
MD53c8f2abbf8937ffd97eb8101889657e6
SHA11fda26059e787ec22907add46cfbbb93df16e527
SHA25615196ca76d2a0d8368b380dc82d00e6a7c51776ce1b6ed3b5c1ebef5cda43a41
SHA512f78bd3edd109f506e6aa62d7777b4c93856351713ef8d4db08d2a9b7b83acd91bd1ffd755c2fc765f3c0fb29d2cfce141c3671ef7d981556400cd13b546be218
-
Filesize
6KB
MD5b8ab1f29bac4217bc659ad4fcc88cac1
SHA1ab55d7f6e6b1322c386ab3b720b48dd500c2169d
SHA256ca9473ca5608e97ec575528c36e196369341b6423ba1edee11be6089a85a1338
SHA5127fcc2ee427bec5bd2f158c75079b158214f83aa26d50cc5fead47d1e726445f318a71335e813960100651c926597b43fc5d3a24f39696286418d39c52307d9db
-
Filesize
6KB
MD54910435bb356f7fb392db92779d80285
SHA192f6c313be967c185f894ba429ed24c90fde2bbd
SHA256d422c45e2bb13e9df7af66f061eb159761a462283be9fd110603f907b4dce869
SHA51210000a3b1829203d2ecb04b8cab8babae67a3cf2f0331197c7d7ae31b3a43a7f9aa145f00c701f237291599e71ebf5a228604a8e2d1623486a7f300bda11a26e
-
Filesize
128KB
MD5f82648c64c25010b93e07a8a7c2ec8b8
SHA1ea0df180e722469eea3c2b2e442b5523b2142b07
SHA256d34394fc13a096cd40adad3899cf14ff07b2ad3fc95aaa9aa663e78512263b09
SHA512e47d38e12d7130e9493362620749bb89e1643e220261b67c272e90064a2c46dbbbcd93f60fbc8848642e8390bcc2f3e22ab2e8c320c712d9dcd4a4efb6bc8da3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd