Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2023, 08:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.indeed.com/r?parenttk=1ddp6896a2tsm800&target=http://daokd.maupjs.Tdecu.sheridanwyolibrary.org/dGVzdEBvdXRsb29rLmNvbQ==
Resource
win10v2004-20230703-en
General
-
Target
https://t.indeed.com/r?parenttk=1ddp6896a2tsm800&target=http://daokd.maupjs.Tdecu.sheridanwyolibrary.org/dGVzdEBvdXRsb29rLmNvbQ==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133344004650391657" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2476 chrome.exe 2476 chrome.exe 3352 chrome.exe 3352 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe Token: SeShutdownPrivilege 2476 chrome.exe Token: SeCreatePagefilePrivilege 2476 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe 2476 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 4860 2476 chrome.exe 84 PID 2476 wrote to memory of 4860 2476 chrome.exe 84 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 4892 2476 chrome.exe 87 PID 2476 wrote to memory of 3264 2476 chrome.exe 88 PID 2476 wrote to memory of 3264 2476 chrome.exe 88 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89 PID 2476 wrote to memory of 2184 2476 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.indeed.com/r?parenttk=1ddp6896a2tsm800&target=http://daokd.maupjs.Tdecu.sheridanwyolibrary.org/dGVzdEBvdXRsb29rLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd547b9758,0x7ffd547b9768,0x7ffd547b97782⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:22⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:82⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:82⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5156 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5292 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3880 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3800 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 --field-trial-handle=1848,i,234120478042097598,4969936309136154886,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58a8d11e3d6d3d064bc3d14456523e539
SHA13946f8d208abcd8227e3e0deffe93e3b1f20dd78
SHA256cefef02fba9d4fae30e487373626e0b964716da01117875fcdd501c97dea699e
SHA5121090ebf37e810f6d295a61032f3a7c3d6792eb55adc9a55912935cd24d206e3d87c45d5e20aa211289023e43c36cae65c31693444c117c0ed126ce0929920b2b
-
Filesize
6KB
MD5cc8116a70e12cbfdb55f1762e3cb8a9e
SHA1d6a7e906252496c429d11a6105009f278eeec17e
SHA2565bcf5f4ff2dc18c214d65657dce8476b5cbab3ae28d9c5acb386fdfbc4f2d524
SHA512aa383623094ea609d8001205cdacba54e5ad32420e1a2cc2b044db2ac8bd885cdafabc3dfa15725d1f2e6b72edd9d2eb6d96f4454acc45e314e238d535de145f
-
Filesize
6KB
MD5aa4d77f7b9e82546ae7c1a3267db7e31
SHA1de26a02bc2e3ba1d5d9588c575e408d749a91c5d
SHA2560e101c26836de0acc6f1b5eb3b97efe2ccfb8123a1e3ee4b17f2033c898c65b4
SHA512953b36c0265339251ec13f9753193d207c291bba23e8e97717034b95f9ace30b349ad6083be7babe3bb689b158e2d6ecf0fba344db749279961ef11a714877ab
-
Filesize
87KB
MD59685c95de22d6028fba59ff913ccd125
SHA173ea1e23f99ad7e0a238a985763c57871a1f3e8e
SHA25637491b26a44d9c539c779c70ab71c48d8fbfab6741c2d4abd846cc3ea12e60fe
SHA512dc86742c9a52ec575406311e11190ae402d00f64643a62fdfc35489998383d057d12f017d12ba247785dd9394e77d392c8bf9efb8d379241d258c74a02c35bf3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd