Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
268s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 19:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trk.klclick3.com/ls/click?upn=DVhTaHpjtpnrnTIBRVrM2ArPuRgsfMXvs5igrBslJMwOXNpziq-2BH8-2BEqh28gfunDdneF_XGNPuh2lSstiw0sAbshdnsQkCtZvw89bc1at52Rcfsgdl3FsR9qkpUG4cHGWPMlXL-2FkrNRrvmi8nuuP8fLMkyytdjf5XIwUhJpdyktC72Vwj0BT6i-2FqWGJU5mHUzeZpTpCiG5QH9K56lqiXDmZ51MrWWkhujBzO7t9C4XWSb7bey7KI3raGTXULpq53Y3QWVjSvQ9ObM2BOCba2IpVGRA-2B5nlySIIHY6Gg5ZMmiOB9ZwqYvUx3k3guitIfva-2BO-2BqK5VQULdU9HLf8IL3Zn0mLjS0l97wA7KKZ8orISoFkRGzq98qyWfmct7C9eMMkh0d
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
https://trk.klclick3.com/ls/click?upn=DVhTaHpjtpnrnTIBRVrM2ArPuRgsfMXvs5igrBslJMwOXNpziq-2BH8-2BEqh28gfunDdneF_XGNPuh2lSstiw0sAbshdnsQkCtZvw89bc1at52Rcfsgdl3FsR9qkpUG4cHGWPMlXL-2FkrNRrvmi8nuuP8fLMkyytdjf5XIwUhJpdyktC72Vwj0BT6i-2FqWGJU5mHUzeZpTpCiG5QH9K56lqiXDmZ51MrWWkhujBzO7t9C4XWSb7bey7KI3raGTXULpq53Y3QWVjSvQ9ObM2BOCba2IpVGRA-2B5nlySIIHY6Gg5ZMmiOB9ZwqYvUx3k3guitIfva-2BO-2BqK5VQULdU9HLf8IL3Zn0mLjS0l97wA7KKZ8orISoFkRGzq98qyWfmct7C9eMMkh0d
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133366000593353240" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 940 chrome.exe 940 chrome.exe 440 chrome.exe 440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 940 chrome.exe 940 chrome.exe 940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeCreatePagefilePrivilege 940 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 5112 940 chrome.exe 50 PID 940 wrote to memory of 5112 940 chrome.exe 50 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 5024 940 chrome.exe 83 PID 940 wrote to memory of 316 940 chrome.exe 82 PID 940 wrote to memory of 316 940 chrome.exe 82 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84 PID 940 wrote to memory of 4244 940 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trk.klclick3.com/ls/click?upn=DVhTaHpjtpnrnTIBRVrM2ArPuRgsfMXvs5igrBslJMwOXNpziq-2BH8-2BEqh28gfunDdneF_XGNPuh2lSstiw0sAbshdnsQkCtZvw89bc1at52Rcfsgdl3FsR9qkpUG4cHGWPMlXL-2FkrNRrvmi8nuuP8fLMkyytdjf5XIwUhJpdyktC72Vwj0BT6i-2FqWGJU5mHUzeZpTpCiG5QH9K56lqiXDmZ51MrWWkhujBzO7t9C4XWSb7bey7KI3raGTXULpq53Y3QWVjSvQ9ObM2BOCba2IpVGRA-2B5nlySIIHY6Gg5ZMmiOB9ZwqYvUx3k3guitIfva-2BO-2BqK5VQULdU9HLf8IL3Zn0mLjS0l97wA7KKZ8orISoFkRGzq98qyWfmct7C9eMMkh0d1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6be99758,0x7ffc6be99768,0x7ffc6be997782⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:82⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:22⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:12⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:12⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3740 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:12⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 --field-trial-handle=1868,i,6321949230211087509,15727773963557807533,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:440
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2564
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
767B
MD5cf4eb005223d617f5607297d36d8e198
SHA1f203f44da68b3c5ff40ec52f581f75588b0bd411
SHA256149d528c6d893e381405329223b30c5c3e1c1467713e60086bcc7fc2826560ec
SHA51274d6ca0563dc20ce37e803204a14fb8d25f29466eb2902d45b8eabc4744ef01f689f7528a44e0e7f8f6a66416674c716c26b696416af33403e1c822baf290af3
-
Filesize
6KB
MD51bb91705e01206fb94bc1f3f7babfb1d
SHA1875fb38f97c099c86a43eb71d110a0dde11bb20a
SHA25635b517f1046c6b41c37a603abc0b4a291cb15f0bd91a294e362a19b9c5fd7cb6
SHA512ef65290fa514db00bd54caec71968d297b6a8dae416943ac5c3cfb216147d58e88025d1edc31b461d7d3a8ddac4b6fd514242a2aa823e1d2460e5a156bf172fe
-
Filesize
6KB
MD52dbb5e5620791506aec9d224228ecb46
SHA1d67d69e0fd9e0f5bff742870283dc33c7ef49975
SHA256b193c40804a4fe41b97de7e55b2dce1036dc442b799d96edb9f6d444ce2b487f
SHA51255d4bd7ca2f08c29396aed9f99b25191bf92b9458a11199074983ac9cce0f5824e0e77b971eb416b8425dd354fea029d82f90d0fab09ca29f8b0e32790bf0f24
-
Filesize
6KB
MD5d1e2da6e0296f3598ef7b65914634c69
SHA19425d37a3e100cb3f43933775c887763419ecfe8
SHA256fc5ec71f3b62afa7c055de39952d80f2c0ee7c9ce675708da9b04ea167dd715c
SHA512e862ea7f6732e627abb5f98ec304e27d4706274339398c76979a40b5ac73a547b81a209eeacb0394d1d60f9d7f8399bb7037d018d29c699cbc8b19de536aa747
-
Filesize
87KB
MD560fd5bd187f6a2be823f4edff516f0ce
SHA1824c134763aa3e895c6ab7bac0755a99d69e112b
SHA256df746ff7c7c81fbfb3770a66a845a3196c6afee8b80f5f0b131b66cb277317b2
SHA512f942a01f06b6c4fe6b7f0e3e40cfc7abfd66c97b970ab144a071d4645723a78aac89854580a19f37ae72602a4773d9622fdaf16d363e496066da1c1e0d285a1e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd