Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 02:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://singaporeairlines.na1.echosign.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAnALd_qzNef7wJEqBAHIk_Ouyb8QDXvPC7z05xLVtvqrNK-PeT9XbgSfNpqzhip6EAOoIMxIQ-iegsD5OLagVLSn0_yFzTFUzgYJrJrGHIO5GlmPc6-s3aCBFUXr6RskB&
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://singaporeairlines.na1.echosign.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAnALd_qzNef7wJEqBAHIk_Ouyb8QDXvPC7z05xLVtvqrNK-PeT9XbgSfNpqzhip6EAOoIMxIQ-iegsD5OLagVLSn0_yFzTFUzgYJrJrGHIO5GlmPc6-s3aCBFUXr6RskB&
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642746224233825" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 5440 chrome.exe 5440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 4304 1860 chrome.exe 90 PID 1860 wrote to memory of 4304 1860 chrome.exe 90 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 2948 1860 chrome.exe 91 PID 1860 wrote to memory of 568 1860 chrome.exe 92 PID 1860 wrote to memory of 568 1860 chrome.exe 92 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93 PID 1860 wrote to memory of 2976 1860 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://singaporeairlines.na1.echosign.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAnALd_qzNef7wJEqBAHIk_Ouyb8QDXvPC7z05xLVtvqrNK-PeT9XbgSfNpqzhip6EAOoIMxIQ-iegsD5OLagVLSn0_yFzTFUzgYJrJrGHIO5GlmPc6-s3aCBFUXr6RskB&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8843fab58,0x7ff8843fab68,0x7ff8843fab782⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:22⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:82⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:82⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:12⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:12⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:82⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:82⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 --field-trial-handle=1684,i,13959116823694898896,7854832054518834177,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5440
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4028,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:81⤵PID:4420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6661ee13-c56a-4ded-85ee-5677fe8c745c.tmp
Filesize7KB
MD5d24556f08b28ca195ca95e77f731a3b3
SHA158b7733a110fb7a0cfe3657d75674753e63ee1c2
SHA256ea069d79ae77e6ecb8a9dce8ba7c2f36898db52279473448306b467046791494
SHA512e35f4725d52a78c040e115bf6e100cdd3f676e8414b6afb5c3fb74499e2812729e53f68ba142a9d3cb99541441b4a8219b304b3827381a26142292d29f87405f
-
Filesize
264B
MD519e9d73d15712c03803d1018b1600ce6
SHA1ba5606d0b9916e2279bd4f2d748760f962aec45b
SHA256346d12da070a7aa96cf8812ad489d5008d67d8fef566ee633346af2cacd1cb93
SHA512804e142a0f72d2fb856db5d956503ea786c154e7fd3bd197df44329caebdb4a2891bfddb769b3ef7dca418b1805ed532b3b02c1af2ca9764abcbe3f082944b53
-
Filesize
2KB
MD55090512608d726cee8dab290b1e02fa1
SHA1371dbb9d428e265e7d45f5e0ef02790233c1c339
SHA256a514b5a48bec977db742339082c77375df2bbad211ce5c4b0af1f1deac15ce2a
SHA51287f150b312866f569689d019a6b3dcacb756a9270154a01eeaa9141c6840eac3eff0c334511b5eb8255a9872f26ca2b1a388d796ce1f895f80def62c3762351d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5b4466a6c35e7eaf7407ece783802eb70
SHA19bc1aebfed1141e8adc43e3691d7957af7d0e5b8
SHA2569d9edad13a3504dc047e4db29edbf8d01b78dd5028d0ff2e195c2270b996a1cd
SHA512ef87e86e431eac8e9164a03662ae22ddae30af8ea2f5bac711582ebd4f02f1706170f1a4bfe125e4e062d4f93eb0f81bfe3102cda7d526e603d2007a1b1f2a71
-
Filesize
7KB
MD566264aae115ad66d9baefaa225c4fde1
SHA15e1a6300ae9aff258f8685b5948ef785b79d495e
SHA256c9f95320b0fe24b26b6d734190beb3a81ab72256c85395d3d4b27f3d27dc9308
SHA512447a2d7b0d83190ef63902ba1625bab71ffbfc6b4c98162db0a73228a1b4647710b487df3758b5f161cfed580d4ab4dab6fd58780696f1e501d579da40cea475
-
Filesize
7KB
MD5eb6e13cc3c48ca92a4476c5f09f25ea6
SHA1690abdaa30c47567024773e9de216f10911634bc
SHA25671e9046a0b2d95fb85abc8aab5cd1f9abd8d42e74fcc1c1cd9f054c803e47ca6
SHA512f44558a9cdd86e018c3ebf2858746ce6561b781e4de401d4d281bdafccdbd01bbe80a6515e62a5ee6355ce73ea9659eb77929d93927385ce8b478ea4b1bb52f2
-
Filesize
138KB
MD532f3892e449f9f01716c20d90f171602
SHA1eda30349d983325a160c17c15f660ad46c03505e
SHA256711601ad91c42efb0c8458ca06ac66d6f9190febcb04d1dac63659273bbeba3c
SHA5126507b19f18cd524765c105c071f48b6b95519806f990b61338147e78261f753f9d2f1c28f6de05448b372b0fcd1b6536966bf667c19ba39edccdc00d2facbe64