Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2023, 16:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.icicibank.com/campaigns/mailers-v2/marketing/2023/march/14/leisure-campaign/1/GB/images/toplogo.gif]
Resource
win10v2004-20230221-en
General
-
Target
https://www.icicibank.com/campaigns/mailers-v2/marketing/2023/march/14/leisure-campaign/1/GB/images/toplogo.gif]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239783686729515" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 4184 chrome.exe 4184 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3856 wrote to memory of 2480 3856 chrome.exe 77 PID 3856 wrote to memory of 2480 3856 chrome.exe 77 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 1012 3856 chrome.exe 86 PID 3856 wrote to memory of 3552 3856 chrome.exe 87 PID 3856 wrote to memory of 3552 3856 chrome.exe 87 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88 PID 3856 wrote to memory of 4072 3856 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.icicibank.com/campaigns/mailers-v2/marketing/2023/march/14/leisure-campaign/1/GB/images/toplogo.gif]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9f2f9758,0x7ffc9f2f9768,0x7ffc9f2f97782⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:22⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:82⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:82⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 --field-trial-handle=1812,i,9140302597410436247,2035743857783672946,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a493d7d2d8c707626e104274ff8110e
SHA16d89d805205f33f5b9b158910dc70fafeb7291b0
SHA256b7ddbff98969be3fa79c4dca6044794e96be82d6d50767558c3b9ca06c80452f
SHA512157f3de64d082eb2402056c1809ee1a3f16f276ae4fa38bf8a6a3fee0151a8e9536b0c4b051577ec8b69950626fda882c38a6f74c2506a7b14a6f2d7504960a7
-
Filesize
539B
MD528c24c00f7bd02cdab186af77df487e4
SHA10554e1e35e8ce7f7e27de2399aaaba36c6f9f98c
SHA2563839fcba4a58588501482e1c7b91367a757a7d0d6bc1a63d30310b006025456a
SHA5129eb938bbff384676b622a73323b45d4f1b838b8e178b24f7f73baba2eba48b7953cf004060f2852ba4d19c81507e9788b9d1697a250d1ef6dd0eb5c68f383dbb
-
Filesize
6KB
MD5b9f601217782605522e287403361b95d
SHA1262cbff9be13abc8204fde4fc732edbb46666e60
SHA2568e2da3e18680dce56fe3d9ccf6af795f7f46fccfd0cb92504dac50651b7bd19c
SHA512e4ed6fd3aa1aaac1d92b4a0cdb18785194f7238d082ea704cbc4017a457f2a7973d40099d9e0adafedf8f570b9cacd6eabe1f13f6481b78a2f7662cfb79ba009
-
Filesize
15KB
MD5d09020ed4ede0a1024e0fc6a6ea629f8
SHA1df5c22e1541c405270d49dcef1e29ece37d8927f
SHA256b6f1aaafe760e2d8bcdd9adf416b721707349235e53b1a3ca495da50d248d104
SHA5122635ce81e4d9ed5187fb696938a2a0b9343dcaa14bfd47a1713ba8b2cdcfd33192304269078fb683daf3722f4e4c78fdfaeaba83bbbb959d901064a57d7080a8
-
Filesize
144KB
MD5070cd6ae06b75d65cdf989e19ef5e294
SHA1b160c7abfec40b60f2b71abf2f4a2dbc890879ce
SHA256916e4bde9322770680e3fe256c0fe877a2d6f90c3c2785530285a6186a9edbc2
SHA5127d29081eccbf7b6098e9f3290ea3bb72972ca40b31dbd9bff3d78705cd9717d1fd7f5f888b311cad55dc1be44cf172ade76837d7ca9e03aa92ab6069c747abd4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd