Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2023, 06:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cm.naukri.com/?redirect=https://56wh718a.hmcobnr.com/aHR0cHM6Ly9mbHZwZ3pqLWhuZC00LmdxL1NtYXJ0cmVkaXJlY3QvdXNlckBlbWFpbC5jb20
Resource
win10v2004-20230220-en
General
-
Target
https://cm.naukri.com/?redirect=https://56wh718a.hmcobnr.com/aHR0cHM6Ly9mbHZwZ3pqLWhuZC00LmdxL1NtYXJ0cmVkaXJlY3QvdXNlckBlbWFpbC5jb20
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133244655820528649" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3776 chrome.exe 3776 chrome.exe 4516 chrome.exe 4516 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe Token: SeShutdownPrivilege 3776 chrome.exe Token: SeCreatePagefilePrivilege 3776 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe 3776 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3776 wrote to memory of 2820 3776 chrome.exe 83 PID 3776 wrote to memory of 2820 3776 chrome.exe 83 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 2556 3776 chrome.exe 84 PID 3776 wrote to memory of 4392 3776 chrome.exe 85 PID 3776 wrote to memory of 4392 3776 chrome.exe 85 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86 PID 3776 wrote to memory of 5092 3776 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://cm.naukri.com/?redirect=https://56wh718a.hmcobnr.com/aHR0cHM6Ly9mbHZwZ3pqLWhuZC00LmdxL1NtYXJ0cmVkaXJlY3QvdXNlckBlbWFpbC5jb201⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe1d89758,0x7fffe1d89768,0x7fffe1d897782⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:22⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:82⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3220 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4556 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3848 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:82⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:82⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5108 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 --field-trial-handle=1836,i,8446855997317926858,2509410376845177287,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556aea2d1c2f086ffe95f1c78a0ef0246
SHA193a6364cae4654264c2c8f6282b42ebbf49bd453
SHA256a9090f03c6a39522e9e4e0fa8206ac77753306e96d132c9bda7592d368cf6db2
SHA512e6a1db8275de1516db2979e6dfa2c65c2cb8ea222712831389bdcf335377d51ae43e9f0a716aad8cfbe2937995898b3167de2c4ac7dbe5a81097cd04d89c9005
-
Filesize
6KB
MD550cb8bf51b36e46795a6600219b14861
SHA13d13b9ea6e692a6ddea5575722a1398ab83daecc
SHA256db942e4225fcd95d45154982834f979757a9852cf71c7f02a864b59507c447ce
SHA51287302bc60463a8da5eeb65f1e329b9afbcac76a1076dd97f6495cc31c4aa8af52688e7d7a9b042c356bf35c36932aa54b1f078f4d2aabf3f2c37ddff08b6153f
-
Filesize
7KB
MD5d19269ba8c53c9332966af4aadb61ae2
SHA1b761c56583d3185f56b1b65a06c6997a4d847e1d
SHA2569ea41b5a58e1a4a875acb33d47104cc8b0ab37a8087b620b8d6177e88126b51d
SHA51246cbed2636da8b8624e142493dff5d95c286c1a96cc57ad394b280341708f0e5ac3b639e00c2de8a05340e66f1b2b8b8cbce91a784421aa3138309da6179fcec
-
Filesize
15KB
MD58e626294658ed39d9381ea6da89da02d
SHA1e0ecce1d7475cfb8e14b353a0232c17658ba5c83
SHA256d0e60b4f16493767f7dc64b257f914225b5b7e184916372193fb7f7fcb4fbb53
SHA5121c33fd7e94204ffce0566f3554842ea87c70e0832b99c0b066ede6fb5dfd48bea0077144fe1a0035518850e4aee37ce5a29e611824a3aad1f5fc5658ba08a6cd
-
Filesize
144KB
MD50327ef91886f92f69eb954805023971f
SHA1b20e881725661e0aee5245cc7263176f798980e1
SHA256953381cf7dba35204b2a40fbe1f65f067fba1517455bbc8a1c629c50299ece30
SHA512f3bf929c25827c62c0b9ea8f103acbb4109d16994d73ff016667b3f900911ae88821f9ac2ad0e96a89e9dbd3d31a53cc19adff73b31f54e33fba02188db864d3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd