Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2023, 13:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://secure.milliyet.com.tr/redirect/Default.aspx?l=https://rebrand.ly/4391eb
Resource
win10v2004-20230221-en
General
-
Target
http://secure.milliyet.com.tr/redirect/Default.aspx?l=https://rebrand.ly/4391eb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133232776198476607" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 804 chrome.exe 804 chrome.exe 3656 chrome.exe 3656 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 804 chrome.exe 804 chrome.exe 804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe Token: SeShutdownPrivilege 804 chrome.exe Token: SeCreatePagefilePrivilege 804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe 804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 804 wrote to memory of 1944 804 chrome.exe 87 PID 804 wrote to memory of 1944 804 chrome.exe 87 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 4600 804 chrome.exe 88 PID 804 wrote to memory of 3852 804 chrome.exe 89 PID 804 wrote to memory of 3852 804 chrome.exe 89 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90 PID 804 wrote to memory of 3472 804 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://secure.milliyet.com.tr/redirect/Default.aspx?l=https://rebrand.ly/4391eb1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8711c9758,0x7ff8711c9768,0x7ff8711c97782⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:22⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:82⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:12⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:12⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4724 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:82⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3444 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:82⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 --field-trial-handle=1772,i,15053949323584279387,4851723417283705740,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4212
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD54cec9d3df74d44791bbea1f20224b1e7
SHA10278fa27a3a11362d01921ee96c66910fa7f5959
SHA256801fed155129d32d848c996bbfb87f44dee04a0638b37bee0d3ca4822ee44dff
SHA5126d3408ae2cd57ee7ccbbd398db675e656d8f03163bcd8b15e665ed7e5ab23cd9a81b899b3c8ce2f0bb545e4f8d1eab9434582b09947bfe8009bad7c942155ac0
-
Filesize
1KB
MD563489f0a98b4d804e0b1907d2e50099a
SHA12ab30c487b6ef05bea59f2283ea023e7a3223143
SHA25686bde6067ca1af605896a173a63d17b98e7a2112049fdd434e5a1e6f2ef316ad
SHA512bcbec105a6ccf8b012fc1dc3a32ad14db59614f259af358ff7e388043a3cf50ad7150a7c6e4e3bb1d931c49661a2ef548479b6b3dacb599e02ac65dd2cdd6078
-
Filesize
1KB
MD524352885a9c0612d9097d9ca878ae441
SHA1f6a617b0d0fd4c06237ff44e9548cf4a198c5920
SHA2565c2d8887f39215dbd99a637aace00538ec9f4c67da878718c9d1dee91404da47
SHA512fa430705f7f51d29a52e1dd5764e254f5d645b9c0dae85ec85a64513dc18ef45ca0d2d873a01ad6c538836f1d540fff9d46c7873fe352d94cdb3e137a76f3bee
-
Filesize
6KB
MD5fb446c5c0a010b602a00b05fdb5cc4cd
SHA13df63a962330c5b07c9bffe4775fba326f4ae1ef
SHA2566e670a32edc493d1a3be2378d430448d20a84bc94ecea2ae8825f8547d96577b
SHA512022787e614fdb188be9f2e2534ffa865ef4599f7091ab2e4bbbd8ec8af5c3d22aed502222a0fc805ce32c16f6fb3fb6b853214f21d793382693d4b6a62b0944f
-
Filesize
15KB
MD5b59743fece7f6cb89daf232d7b5da377
SHA162ea84a3b80ac3a284ed2cb06038c3a69df258e8
SHA2560550d181d9557271605cbac8618f2b57699105f3bf1ed941c8b936672d9450b4
SHA512582280b661a1802154a12227a842bb28e8e234fc7abe8d56b84207822d284ff4e7fd75f4f699cbc9139a7142521a4678db57cb5db10db113e6bb1d1041c452f4
-
Filesize
144KB
MD516432d6a3277b6daeb80bd94e3482a67
SHA1877dcad6dda8c0c4e185284a20748f22bfc18940
SHA256c9bc6f837e11f85fce8b9238cfcbb30dac568448b877787676e08816d6328bee
SHA51233d83c21494b0347fa131902f14960ad85e943fe943e869b6bd73ebf4f90787139638499cca988f7724a6f6532a356d492d884dc13af94d84cd28f973377c8f2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd