Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 00:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.yesware.com/tt/745049c77cf3cc37ffaf320f651a53a6686ba130/3b183871027430cdfabeb460e0ab644f/64e9f37efc40139e4af22d29fc86a23b/calendly.com/universityadvisors/tfpc
Resource
win10v2004-20230703-en
General
-
Target
https://t.yesware.com/tt/745049c77cf3cc37ffaf320f651a53a6686ba130/3b183871027430cdfabeb460e0ab644f/64e9f37efc40139e4af22d29fc86a23b/calendly.com/universityadvisors/tfpc
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133366196190544418" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4480 chrome.exe 4480 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2148 4480 chrome.exe 54 PID 4480 wrote to memory of 2148 4480 chrome.exe 54 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 4400 4480 chrome.exe 84 PID 4480 wrote to memory of 3664 4480 chrome.exe 85 PID 4480 wrote to memory of 3664 4480 chrome.exe 85 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86 PID 4480 wrote to memory of 4752 4480 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.yesware.com/tt/745049c77cf3cc37ffaf320f651a53a6686ba130/3b183871027430cdfabeb460e0ab644f/64e9f37efc40139e4af22d29fc86a23b/calendly.com/universityadvisors/tfpc1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3c499758,0x7ffc3c499768,0x7ffc3c4997782⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:22⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:82⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:82⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4696 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3960 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5180 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5508 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:12⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:82⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5028
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD52a9c0a1074358185eeb6b70954ebdfe9
SHA1c944e4dc2d1c703937ba0c9ada25927bb3373983
SHA2564dadc11ec68efc62c2ec5fdddca582d3f3bc413b85351b5d3d7285cf8d2f0cd4
SHA51229c9d5895fcbdcb5999a40a5068d378b86c50a2ccda983049dcf5b9a184fb2d1162fa0a7225f1a6ae07b993fa4d251f6aefe5df008c055fe1c2fc859c135b339
-
Filesize
1KB
MD5f38389f31741e0222fe2946dbf49e810
SHA1c916eef47d414b3f026ab6a77ccee20ed255322b
SHA256167d4e1e5d579a6429047b339a72f4e72477ffc36a0dc3b6163f629aa0c257f1
SHA512ddbf5b576dbfd4511126c77e42b540d9be96cfd8682d8140f77f4c0ec6407ae2f9da7b0cb938f7900be04a587a7649a17a3742e4567ecaa3123e658d1b734415
-
Filesize
2KB
MD59a57917173e6ae8202753dd5b1d3f03e
SHA154fecc54802a93ecb04d0ea8b8e34914eb1d245f
SHA256215b755f03ab2374d2518ba2cb7cb36d182d6c1d54009fd5c22053c2da115d18
SHA512086527b0f13ce06804ae98b6cf2c594afe469b4024f6d9bc2e01c91427255f80fc05a52a8a1bc6a080562e80e486c8a941b39ed2f74f34f335e6a0b3712f5bdd
-
Filesize
2KB
MD511b7616e27749596bd40078dfa3d2f31
SHA1d696d960306880ca7169302445fa7753b0b6e003
SHA2567d73be0461dfc1debbfdea28c41547dfa7c1f197e294fa60fe3774c18697cf95
SHA51204b8884562e78be70290566281429828849847150e49f5f679174b9e74553b1ec7b57b60b6223fa3ac0e357dd62f7d14bd0af24dd1ab59f446d93edd4b001135
-
Filesize
2KB
MD56c68719ac28edc3f7c095afa3c51ed16
SHA10945517b431c8914c563ac03ebe23befb7422066
SHA256b73ed51fafa245645dedd4fd97c478fff2ab0eade94fb31aaf588430d58aa6c1
SHA51237a8a1a6714e4d200b512ef8f171ae0ef0d259aed8f060162a3e7693710ec2cee56d3e9a72f4677a72f85ff1e2f8d46acedf79bad227b91c9bf6255c731764ac
-
Filesize
6KB
MD5538b63dbdb4ee089761c1c76cfa0b529
SHA17137dadce7093290b33022cb648f4ef5aef50263
SHA256c77f510dd257bb92cfdf40f73ece8cf0a0dacd78cbb09b06b7f3a74be5d6e3f4
SHA512bcb8f318627303be0efd11a300bddbb102d5dbf2e1d3e6837ac9aa327bef6d5f39f4234a3e3494155e98069e69394e0a56466bfcd194084062159c4f770d5b56
-
Filesize
6KB
MD5b4fec2cff58d76c791e66ea84ea19c94
SHA110d6a5af3450169ba99c383c38dd7af13d8ae39d
SHA256cd40257fc7f457e5087b7a864aa9d76c3d3b496c11b3d59b74219673b2718561
SHA512b61a7e8cd4702e2a1f81519be73a1354b3fad2d0caffddb0cac65668161700c02ffc8991072603138927653e3acaf4134637025cd487fff4747c09a9057d3166
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f08f4ec3-16a3-4da6-8a8d-3db39b9920b6.tmp
Filesize6KB
MD51767bc1db7b537a347f39e4551597296
SHA14d2dcb4c6ec6a025b39daa5195078915d70a9a66
SHA256671e90ad003b2b96dfe52b639e281c6167de28dd7ad4bbc39c5010838c973485
SHA512b560f16adfe39fdd70a61358eed5a4a4b33f47f2bd5e95188d93548d95180ff034bdd34b7b357d62c4468b4c888c969fae9e272aebcc40bef578a146c136e0b6
-
Filesize
87KB
MD5c154c01267df206eae8f0571a68d26b1
SHA1db951498d6cd920bbd461f488f2654fec2dc8692
SHA256745adb4ba7d545668e4f2d840f76e98f16452df60077a709f53556b3495806cc
SHA512ebae9fba8c21d7040bc08247858b6a4380d1fd8071106a99d0e97093e21a19e554abea7478199bc9292e73a5fefce635cd745514808d60c8de2e515b090fd769
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd