Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2025, 20:34
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Detected phishing page
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133816196952451801" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4904 chrome.exe 4904 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe Token: SeShutdownPrivilege 4904 chrome.exe Token: SeCreatePagefilePrivilege 4904 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe 4904 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 2160 4904 chrome.exe 83 PID 4904 wrote to memory of 2160 4904 chrome.exe 83 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 1484 4904 chrome.exe 84 PID 4904 wrote to memory of 3804 4904 chrome.exe 85 PID 4904 wrote to memory of 3804 4904 chrome.exe 85 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86 PID 4904 wrote to memory of 3280 4904 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://embeds.beehiiv.com/c1c50799-0fc7-4b07-9b1e-b48b3ca31a121⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc6cc9cc40,0x7ffc6cc9cc4c,0x7ffc6cc9cc582⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1880 /prefetch:22⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:32⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:82⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:82⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4884,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5028,i,883997411502912531,15042043510009830073,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5a68d536cf3a7754f89c292806fd34e84
SHA1232ac5011f83de61a095f11d6579a99b063c7b1c
SHA25635f0a07b2c1551a2636fa01630f972fb5aa6cfff26a36294b3fb35a4dbfc5aec
SHA5129250e69f6895c1eab9f49b7595bb78ebe5e5e93c1f10b918529f8aebec55501fbd35a35034e3f8c8dd9f33e2b80c38505f24da3c8b8b51cac4f70f7cfadf76ac
-
Filesize
216B
MD575b0707b14fcf22fcbbaf47f0d80976e
SHA1dffdd60d9991a286fe3d2adb339328dccdb9d40c
SHA2562faac6a6b6f74a84628a8aca4064ad85f8f99101725705a7524a4631e5f4709a
SHA5125101dbc1894427a661461790ef198d0e2871d5950e7b93d52137febad6e1811027c337f3414c474d06d53a4d4f32b01bb6bc5c6f7bdee8144190e8b45084e95b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5fb05cb6d7768fc193d62b71ba2112173
SHA194b673e77c3a90aba26605b064bd7ac7e6607a2a
SHA256a45b3a67660ac26b8251291d716a9d0da51326ca81f6593c71e9264b1bc420c0
SHA5125cce7fcc3e13aa5f6f6a32f227a003d71b72dcef01bf4fe08f7f6de644b0b473a0fa25339d73306f9b4affa8b77b913cb737ff6b1f97b01f3c9f46cca4453a6c
-
Filesize
10KB
MD50cd5e029bd5552e3d183886446505cb8
SHA163a8a3d58bc5412fee1278757b13be5f3b1d1029
SHA256a8ec83d7cb24396bb6b17f618ce54ec34ccd84520d4dcb36847571d29b2ce787
SHA512e6a6a8eb8f1dc88ff4ca39522593032ddca73b3f5f22740539913d6d9d6f567f6d13625d55ecd641abd80ec0fbb712f180f51659a3ca3eb6c751ace0239ae7e8
-
Filesize
9KB
MD558f10f101f02d2f374426f004691f4a6
SHA129ec9e189d13dab59a620e61df11aa89110a4f51
SHA25665a2efdacf7e764851d82da5b0f1454c6fd0f4c3107301f4f8ed9f9feb8a8cbd
SHA5128a5d2383200a34c6ba38bfceb1ae84b32b764538544e0d3fd402121d82431375c9a44595512988fd0f697c4fd1f0183b362663b8615e2572d30991b8f0df8c17
-
Filesize
10KB
MD590fdca5d0efa4b9a5cb9be1662ae0158
SHA1e7ebd7a9aa1d1ed8d4ae180e32002da75b896135
SHA2565e5cd2261c874d30a784cb4b91c7244c97a286d17d8a23b9676b44821f5d63e7
SHA51215cbd3c212d2bf6e09bfda16f8f43e7726449501892d671aecca505554130117191fa3d4e06d0211fd2e03b1ec42a02e2a6cef10bdf3ad5f43ed627abe28ffee
-
Filesize
116KB
MD5ce8ceadcd1a8c16c68e979c420ceab41
SHA1078f4636a2f8b1fe11cff074ed9219646978ca47
SHA2565393ba7609f4edb5359c249fffd2636352cd8649a067fb6dedf86f153306bfa1
SHA512474fd163b8494eb68f32236a03de3407e0c7b31462a4ddc5f9b10996a80cf5a8afea7154e6a9a9e35244f6ca2a3f8575a3f73a2bf6c7d03214e145ac2446fbeb
-
Filesize
116KB
MD509d85d4919c755f71fc276131bf625cd
SHA148d0e62aaa2115e26fecedcba27e9ba67a9bd598
SHA25617e24ce0eb41b8cf2c590999ecb1c243f624392af16190bed1c70636d4058147
SHA5127460a1afa4e1fe5195e2446aff27c827f6f439536ad025854f31a62df7438464070d1a186fc449a0d3f29c16cb9116d74ad94f097759a476d437b96ce593a7a6
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84