Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2023, 09:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://links.mail.service-airfrance.com/ctt?m=8540701&r=LTYxNTAwMzk1MDYS1&b=0&j=MTk5NDA5Njk2OAS2&k=AF_ICI_COVID19_HEADER&kx=1&kt=12&kd=http://up1.pyi.doktorali.com.tr.///?YYY%3A%2F%2F%23.bWljaGFlbC5zdGFobEBraXJrYmkuY29t
Resource
win10v2004-20230220-en
General
-
Target
https://links.mail.service-airfrance.com/ctt?m=8540701&r=LTYxNTAwMzk1MDYS1&b=0&j=MTk5NDA5Njk2OAS2&k=AF_ICI_COVID19_HEADER&kx=1&kt=12&kd=http://up1.pyi.doktorali.com.tr.///?YYY%3A%2F%2F%23.bWljaGFlbC5zdGFobEBraXJrYmkuY29t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133223144203977965" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe Token: SeShutdownPrivilege 2144 chrome.exe Token: SeCreatePagefilePrivilege 2144 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe 2144 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 3724 2144 chrome.exe 86 PID 2144 wrote to memory of 3724 2144 chrome.exe 86 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 1580 2144 chrome.exe 87 PID 2144 wrote to memory of 2024 2144 chrome.exe 88 PID 2144 wrote to memory of 2024 2144 chrome.exe 88 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89 PID 2144 wrote to memory of 5068 2144 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://links.mail.service-airfrance.com/ctt?m=8540701&r=LTYxNTAwMzk1MDYS1&b=0&j=MTk5NDA5Njk2OAS2&k=AF_ICI_COVID19_HEADER&kx=1&kt=12&kd=http://up1.pyi.doktorali.com.tr.///?YYY%3A%2F%2F%23.bWljaGFlbC5zdGFobEBraXJrYmkuY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d0449758,0x7ff9d0449768,0x7ff9d04497782⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:22⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4992 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1840,i,13835125478036348229,11208200087095353556,131072 /prefetch:82⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD524e0289b7a3dbbb08ee788280f11a430
SHA1a47f2090ae6c3d82239193446dacf183f48b25d4
SHA256153b73dc037afaf6351daef719dfa5b767081e413a06b1993f398d295e1d2ce5
SHA512c557f971f4d5d536086673987ae2e9e5041b8c0cc61017209ae209785003f70ff523d1e12837e6271cb9307ded5ae7aa3cbe1f37ad09eb88810f7c1c61650d8d
-
Filesize
538B
MD57ca14b8df177f3a7902a29037faf452c
SHA1e5f3ebb9900210232029527dd5e56b40d4420ac3
SHA256220bf6623c128a4658e676543a90a325011fb84a54577142f10387e9f3a87465
SHA512cbbce5fbe8c2c4b83d15336941181cf6f5f27532472260bcff3ae2e8e417a2f6af56316e897c3bf8a837c17d0404fd0d0537539d7951a952a18324f21bc3fc73
-
Filesize
6KB
MD504c5b0402879099366f0ef7f5083e81e
SHA1b67d46024847064c77d4fc3c338cfdf560b244b2
SHA2569c003db6924e1a0fb64270a2787372f513b1607f6a719870d7df5fd3fb9cc502
SHA51299f3a361c1287fd8f40f9f73913f46e89149609f01700ab64679e41e66432afe48964a7ab56d0d02adb17812e0badccf858f89fb9142a6b8b1b57f492b9a6194
-
Filesize
15KB
MD5af974ddcf5c193782ad64fed7d0ddf72
SHA19f8b8633627ca45fefc7bfcb11bbd2850c83b16d
SHA256ba984eeaeb5c0b030640f8d7a070ddde177c91bd084a6b72d4f26df5e3626c85
SHA512e84acd7d26701570e2176ef3ca201168e646e16327f62668ae4fd99bd0c0a72fde0fc573b3137e035e3e6ad447f12210328a19a71a3d68ce64943c25920da474
-
Filesize
144KB
MD59cc80eaed7ff818aef2ab45d8fe11992
SHA1856635d7296db1035daa4ce85a819d63362540d2
SHA256b55fbdfe014c12033c0c1029645d16a1c21c92d51c7e6305ff2888e384266441
SHA5122bea83d880deb3cc3684a2531194ec72729b02073b6851c4c1c01d0bf6abc6c8bc6d20ddbcbcbf617a4595c4ce8c9fa4f26b4eb8833e9436b1fbda5e92de77ef
-
Filesize
72KB
MD5a49238a7d0016dd4d955626caa7e40d7
SHA1b96dc131adfada95b65a2fb6f2da1eeb99ab48e9
SHA256bdf774937cca59050c43ac66f2e5da7f71d652b9dde26e6a21239a78b1342e9f
SHA512d328cf6da0c5acc2fd9eaf2039a1ca44f595cf3ae09a1dbac8a271f606efbe605acf80030d9ca7cd7deac90d15b013040902142fee90d77679ef629dfbaf72c7
-
Filesize
144KB
MD52cf00f4b5c02f9627678beb748590785
SHA1377ba77edb66372afb637bb9921ee516b978e6cb
SHA25610bc52a5ff0e02098b89d624b8a3fef17fde867119e32f7414590773f2d707ec
SHA512fb41c35e7d1a65af00dcb7436b62d88363725a72eeb85ecaeb4d54bd18b14e9f9815ade1741a22486701a5fd64d7da0f89efda039daab7647e8c637e01a8369f
-
Filesize
143KB
MD5d32ac526176c659a9be0f62f053bfa0d
SHA13a368e3d0036e90632f2d7a1786986ee5bf07393
SHA256ded31759e2704fc30fdbbf3d49a35b820fcf484d97eedd8e2abd7026495e939f
SHA51270ef9e05dd38d94ad13162184d73c6ccaee68ebd97ee7555ef0b68bba69ddc3c40994b8159e389b9e73e028a8524afde414d1f30e220105819e3f6c17a63dc8c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd