Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
279s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 01:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi
Resource
android-x86-arm-20240624-en
android-9-x86
Behavioral task
behavioral3
Sample
http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi
Resource
android-x64-20240624-en
android-10-x64
Behavioral task
behavioral4
Sample
http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi
Resource
android-x64-arm64-20240624-en
android-11-x64
General
-
Target
http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640104343268636" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 888 chrome.exe 888 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe Token: SeShutdownPrivilege 1596 chrome.exe Token: SeCreatePagefilePrivilege 1596 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe 1596 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1232 1596 chrome.exe 82 PID 1596 wrote to memory of 1232 1596 chrome.exe 82 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 3536 1596 chrome.exe 83 PID 1596 wrote to memory of 4308 1596 chrome.exe 84 PID 1596 wrote to memory of 4308 1596 chrome.exe 84 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85 PID 1596 wrote to memory of 1264 1596 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.crm.wix.com/ls/click?upn=u001.YkUcqK7CAiuA8gbNAkEvtjZwAzFXTyEt-2BUnUqFm7XoOCvJVpNJk8V4Ef6murGEsz1-2FXMqOsNwW7AdC-2FQcumJeA-3D-3DS5mK_EGkwtaoMqC4gED9WMEatEqeyP7eQtscKGGQbTgRqptP38TJpy-2F5SXy6aKYvhgJsQaM7yrS-2FZx0XrQhVL7juMPCdnTWjmss7Hm7FPfo4tQ1ELaK8huSj5gk-2Bo9L126Sp5dxcw80Tnl3NWjAM-2FXOGPkv9S4Pia-2F7gmjnMqJ32T876J6009Gabc09rMBZuoFm2muc9vkLCX7boEN-2BoNQtTD1GyTGCHCXf-2BgHMRcvmgaRL8yVzPxfunqXQ7l4G4Eu0w9f0dgVZj5NJE-2BGdep3Qajir-2FggOV-2FnlIofjtn5GKND5DAWJNlZP2Mogz5Qw-2Bcn1iGwlnChCVuIRT4roY-2BWmVKlGXUmFlgEkvkXjiLFLF5V-2BGLmS0JNAkLx5ouPEJq-2BNMo-2FlkkVwHCDEaHjE4ig-2BP-2BwJ5X0-2B8HlUMyFow7IMbHdsjYBBMH5yjfkFcTPNg6QC5PcQUBrBjiYgZBZD1tH0plotB4dYi8KKROVzSfXCxLrVabJgQFJCNLYHTgIKAXQkz0HfT9N1JxFdH2r850ggOd7V5ZkEuSpX-2BPa4sAuWmq6cvS-2BvF5-2Bkb7Bgkx216aFqgGfJTcPZTSbh8WijVpvuvVQRieBzCz1xPCa8a4LypOBRHpd8w3Lnq-2BuP6g1EdRedrnQ-2BekRhHnysa1JUA1stbmMus-2BLgbFCc5GQLnWPP4bJMhhO7E5e8UyLST8C5TGMqI4uKuteDBbVeKWzO9O-2FE6RLyfVUydrh90wqSp6Rpi0TAHSc3DlYWUeffdTxaRtbvy6wm7-2Fcx-2BJ36oMpZYyNAC6y8Ucw-2BrngsmUCCA0ErR0MO-2F8zvKjvw8Skz9r0TVL4Wi1camuKKGZeLmEeFPtotwpQ0f0NenHMrwcR0b5keQSLQDevkvsrqCaPt-2F8jkFH1n8eSAQFQTCjMYlD6-2B0XQGkktffMWd-2BqCJLw-2B-2FZw43WOmYz2j02Hno4k9kIB78J-2B6u8tr2EiI13TkJkYjbr3jCRZ01W6TjKjtkS-2BT1KuDu4xNlPtatT5r6We5-2FJfNABQllOi1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec8e2ab58,0x7ffec8e2ab68,0x7ffec8e2ab782⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:22⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:82⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3912 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4432 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:82⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:82⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4072 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1556 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=304 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:12⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2500 --field-trial-handle=1808,i,7210488868422951515,3343290506504630966,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:888
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ee4eaed14c78809ae0c4ae5e073c134f
SHA15dd91fc1f7ad9d12215b9aade0c72af9c52ff3b5
SHA256b1724cd673ddf3a1f42fbbe6fb30fa4d714e71329a88a47aee242f2045c3c40e
SHA512c370ae2c55cfbc8cab4987e1095bdc647619b64eec001a1bdc52b06d6e55abca2a9f7c1759cb5922522fd4a52282fc9c156aef43fe484899bccf8ade0e91e1fa
-
Filesize
1KB
MD57ec8b42d0549c401e6a0953edfbdfeb3
SHA146c0b0dbcf7971d14620371aea9e3ba9644c5e6e
SHA25632c05ef45b4038571aa3ca0067df348fe0399fb98269863ea2e7ad54284e59f4
SHA5121d6943a7d7ec8b3412cdb0828849b0115e944fce8779420c5ef7cc6e62186fe10636586fd23122760df80c6abd9864f0f2f78c6fe3219becf2ecb8c2cd3134d4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5056d3e8fde678f3a6e5e3ff15a7bcd8d
SHA1da5f29c19c709f569eb67d125de5a144473242cd
SHA2560992545e939d376c33d39136b21e7fca2da16a4ac1d02dade1d3d3bb73bbdb96
SHA512c600110ec6b4b9438dc8d0f7d1f41cf330e597252b41bbace77ceec904482aad0cd5226e6ea2997b26ec1b0b54d4a3878c7dfaa3b286f5f4efd1054cbee467c3
-
Filesize
138KB
MD5dacf0e31961c89fc38376561bf2db47b
SHA1e4328fc4f9f4d45d50b1093c7802828ae9c2e740
SHA256548d8d78cf49c92a0ba779c9327e5621c4b2183a9aa78fa3526beb5f2a7709bb
SHA5126d8a0ffbff902e12415fd52e5ee4fd81ba45d160b1f2cbda278de1d42b6062cc8603a6ed3ea36bcf66fc47b681ebc08f32c2b196f738e220329efa7b89716b71