Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 13:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://my.dealersocket.com/emailtrack/track/track?siteId=19&sentId=51150&entityId=607895&emailType=doc&redirectLink=https://hermestravel.ir/pt/v7qxcj%2F%2F%2F%[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://my.dealersocket.com/emailtrack/track/track?siteId=19&sentId=51150&entityId=607895&emailType=doc&redirectLink=https://hermestravel.ir/pt/v7qxcj%2F%2F%2F%[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238836171748551" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeCreatePagefilePrivilege 2056 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 5100 2056 chrome.exe 83 PID 2056 wrote to memory of 5100 2056 chrome.exe 83 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 3616 2056 chrome.exe 84 PID 2056 wrote to memory of 2244 2056 chrome.exe 85 PID 2056 wrote to memory of 2244 2056 chrome.exe 85 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86 PID 2056 wrote to memory of 244 2056 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://my.dealersocket.com/emailtrack/track/track?siteId=19&sentId=51150&entityId=607895&emailType=doc&redirectLink=https://hermestravel.ir/pt/v7qxcj%2F%2F%2F%[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc69d9758,0x7fffc69d9768,0x7fffc69d97782⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:22⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:12⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2872 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:12⤵PID:572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3384 --field-trial-handle=1912,i,5340155202896535366,12168676413514797107,131072 /prefetch:12⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5aac5bb9e82532160cd6aa9d6d6e34154
SHA19e4fe9c15114922a371a6e8d60265516f0d9ab56
SHA256eba163f5752c86194a8cf76d1bbe0c67b677fb82328b5d670afc32e2c3487581
SHA5125909e03bf3bc2bc8423515bd12898a44349017c58d01481cdb62e412587ffd7ce45ecc815382c31bfcdf4f288bc22dd44e27863dd2647ee2a2768e04bf6c6e71
-
Filesize
6KB
MD5bf6ed27edc68f32baa0888046db83bd5
SHA1ed6ac388a8c7df922c309d3905d4e43f9c10d7cc
SHA2565abe5c2b293a61f58dc4ce040e3df46edf74abc5c4962db9d864f6d2083cb923
SHA512d51c6a620abebf1b7507f8fad58ace0d6d0c5df34ae1379668c35b6bd7d73d6e8050689f8ed25558c1bcb747a608ee8703ac4bd5280f967572ebfa415fbfdbad
-
Filesize
6KB
MD57466e4b29d5efd660eadbff0988ab3d5
SHA115ea5a8198db31369bff45d5e8217bd176f5b616
SHA25627e2b1bb69365d6bdbe763e3a7e55a4abad1ccba3aa07bac29297250f5b2654c
SHA512d604268da60987499ea39a55f336375785cf94d9bc57ab63d2a01088b6450d89fd9193c42be7860f86ee30298aa39843dbdb7ab3128e1ffae58158cf8a965dfb
-
Filesize
15KB
MD5cb6ee16569bc889e5f1b198c1e471576
SHA19fe2eb098c95f55eb1d0a1b7a7805a1d85d5ad75
SHA256424fcd37ec048d1d62032bfdb345d9b8e5c6b4d5d0001b5e5c5ebe09b6d18795
SHA5127affe90529b793ad41126794734e0d634d0a1925b58aa2f3a7924c7aa0e8f92e1af757c7493a2a6a7aebb8138ab66e3ed7aff988ea7bb4a1b54a716218122d25
-
Filesize
72KB
MD56d5f4f475041e99001f8c4d70406063a
SHA13ea47c1d68dd51531d2789facc69c209b69636c1
SHA2560708d1afafb214522ba086a77b1d43334f18bb4782af0ebe5ad90db5f1ad3096
SHA512f868f887b4e2ceb4b73668def93c75fed987aa28d3c6db2099910c09b0110176f1b0a1878e6b577423fe610c6a006fb64e9eb135cd6896e18317d50e4c6927e1
-
Filesize
145KB
MD58d2338107890746279e139fd7cd2b489
SHA122639f6f1066a992262a20ad097aa85e4c988d6b
SHA256cdf77b0dbeda3c26ef052d4a76339f254e6dfc8c5ed23e0386561f34b0e514b7
SHA5128ae84b2ce6e543656f914fe8e7078ab957d476de038baafe835cd8f9757a04915388c52c6aa3a459d473ead602a1524d4cd40b98a239d01ff0c586ed5e11ccc2
-
Filesize
145KB
MD5aea0defeb5ca47ec8428a9ad1ffff8f9
SHA108b26ce1c1b7fa39c503f33fb17749bbe597f0c3
SHA256b3210d8b122afe1c2d6941f21346c3f2edb95f140c50f142b682878c1ca0bc36
SHA512e783df1fab5bb78f507791bcc57c4e7397bb2edc5b4ab3a582b460cd1fbaf44e397b224814fe53d9354250c26d45027405817c58f91867d492b33fef6dd065f5
-
Filesize
146KB
MD57d070dc0a10adca8f800454b261224bd
SHA1dc52a7929a0db7c6305592ab8c5dc098b1f1bcf6
SHA256e2cb79c0e78cc59eeca2094fe411dcbfedf3c5de353ea779abb3fa6fd20261c0
SHA512aa9a109d9de88b2874eefa7d435fd0f7204c2ffecf74c03755044358be96ff01a821449bd9a628e968d743cd78a5bba8876c1e4b0af79983cf1eef6d38392c73
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd