Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 11:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://aka.ms/LearnAboutSenderIdentification
Resource
win10v2004-20240426-en
General
-
Target
https://aka.ms/LearnAboutSenderIdentification
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625788030766352" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 chrome.exe 2672 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeCreatePagefilePrivilege 2672 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4520 2672 chrome.exe 83 PID 2672 wrote to memory of 4520 2672 chrome.exe 83 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 4164 2672 chrome.exe 84 PID 2672 wrote to memory of 1028 2672 chrome.exe 85 PID 2672 wrote to memory of 1028 2672 chrome.exe 85 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86 PID 2672 wrote to memory of 2232 2672 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aka.ms/LearnAboutSenderIdentification1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28d3ab58,0x7fff28d3ab68,0x7fff28d3ab782⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:22⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4156 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3144 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4344 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4728 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:12⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1812,i,7738656496151406779,8723267505083407037,131072 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD56983485a261530d728851d8cc155f2a4
SHA14b87a2e2ccfb43f6b910a5be9a425ae6e2975ea9
SHA256ec89bc01a4164fc9d5963ef0d1d3a2b3a92050a17306c876e14c78c0684e72e0
SHA512da61b5bbae47dd2dea37a8c631176add5c9590994cea2b84474017d04ed06c7dfdca2dc133dd4f28c162b308b2cafa25fd92a0108e0bc33563ddabf2e5aace1e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD57319f1d016db4a65993d83973216ddc6
SHA182872189eea51ad10c82ac0fb1fe5d073a25fd76
SHA256dd16d266c6896fa493ad6f794a20773a6b4f3e1fe90c014662d04e41d71d5e36
SHA512df7a1f4ec6dfb604e8d0db103bba66c059a6fdcbe49501a866df50df2385764a9a8db8a9f1c7c325383f794b09109959d50ca82ee7b387fca000e954c1c62913
-
Filesize
1KB
MD59fe1f979b3891e390e07ae50ad8c0ede
SHA1639586c208acd2f471d4604b2a6302596dab7ab8
SHA25690731ef09acadb976f00afc9a51b81c3402e2dc21f2609fa1ca94fd39039a9d7
SHA512817035de4cbf06c7bf92dd6621a6bce2915e59fb19523fd05823d51efb52b18403d858d77b299c50e4e43189a20d2d0c120efd2d451ec128df28c81c8c51d38f
-
Filesize
7KB
MD57dc63f1355ab24d26dd6ed4216f3098e
SHA11fce589eb8571f9f1ef8fd4469f4bc7c5a916252
SHA2562e418ef1c81187df970a854e612ea554719fe1dc2dd920e138f3455326711eea
SHA512308e5bc8fd17698bf4fd6c1382ef2d8a154500d53834cc7961f13abfb36d4001c99421f5bb755982be830c4ce99785a2db708731b61570fdfbf942152eb6cd79
-
Filesize
130KB
MD517c8db925e3f474741fe2f013fbc0dda
SHA16a07b8d8f4e8374489beeb70352d77ac65455d02
SHA256302322af7f5ab4eb479ef7c9dbc40568d7c730940cdb50bc6d196e9b01cd6ba1
SHA5123e908d6bac72bd9a2ca0c4e66ca60e327c178ccc78e88fccf57fb3a3b16c1d09476d384ad6350455d5967ef02517dafd1175f0227bafc808f153538414dd91bb