Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 17:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChBRzlLDFC0MzqBCnF4bAHe2EP0J%2F/1/01010189feed2b9f-bf3e21b5-8524-4113-b963-91c256c111a8-000000/hodP30HI7iPSh3ChlYg_bP7up3JwDR5pbsm69xrMKkw=314
Resource
win10v2004-20230703-en
General
-
Target
https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChBRzlLDFC0MzqBCnF4bAHe2EP0J%2F/1/01010189feed2b9f-bf3e21b5-8524-4113-b963-91c256c111a8-000000/hodP30HI7iPSh3ChlYg_bP7up3JwDR5pbsm69xrMKkw=314
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133366806046517486" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3896 chrome.exe 3896 chrome.exe 4204 chrome.exe 4204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe Token: SeShutdownPrivilege 3896 chrome.exe Token: SeCreatePagefilePrivilege 3896 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe 3896 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2324 3896 chrome.exe 80 PID 3896 wrote to memory of 2324 3896 chrome.exe 80 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 824 3896 chrome.exe 82 PID 3896 wrote to memory of 4868 3896 chrome.exe 83 PID 3896 wrote to memory of 4868 3896 chrome.exe 83 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84 PID 3896 wrote to memory of 4700 3896 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChBRzlLDFC0MzqBCnF4bAHe2EP0J%2F/1/01010189feed2b9f-bf3e21b5-8524-4113-b963-91c256c111a8-000000/hodP30HI7iPSh3ChlYg_bP7up3JwDR5pbsm69xrMKkw=3141⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03de9758,0x7fff03de9768,0x7fff03de97782⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:22⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:12⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:12⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4852 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:12⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:82⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:82⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3924 --field-trial-handle=1872,i,2483844924287340784,11835347958052688862,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
552B
MD550d460a63144ba4c886bdaf9deac5da8
SHA12263bd04ca1e977439e575fddedcf071ef84b75c
SHA256a46e5e914ecb84f9fb6ad30819fce89b378ebfd3aeccb717a3c25b40ba6f2f39
SHA5127f71111189dc640b00a843a82a7590f964547e6f3a2146eedb6c22d44bfa8324eb8734446c60a7e6234c77cb5a44e3920f343db07c783cd0ae91acf29eb64049
-
Filesize
2KB
MD5b42cb22c480a2a855c4f80a6b7c63eea
SHA1bd169642b71106da9fc886b71c4274cf1b65eb00
SHA2566b815bd53f49b40cc61b0345142cd615b8a1d87ef29f127a47789ac32cda0dd6
SHA512a2967da581105a5e57715a7e8400d0e77983ed445346eabe49ee3118033a4d1c6f343ade14cdbdf49b6a7274661d719c9561e5d919417540dbed8354849d99e8
-
Filesize
1KB
MD587bd6825dac8582c50de5397ac0751b9
SHA10d41527e2140120f001f33112f21936df2051930
SHA25644aca98558337803718e0e23df8b12f8cb30febc1932f28aed823dc2e8386ad4
SHA512e5adc7e33038c8340cecd8f135a54d76ff1d7053dce0e81020bfd9422b7e19267a649b77ab5530e99320ed749e954b924570da5824d4b82ebb7866639851a751
-
Filesize
6KB
MD51668f5bb562dd3341bf98390a535f88d
SHA19e3263d5bb7b9df617c5c40c1a4fa6f4ebddd367
SHA256220759239abfa5ef93cca1688ab98232059a7b55d168c40c145bb11f293e25c3
SHA5123abd992816368ed47debf2100fb4565e1fb4862e1e61cf1008ab1fefeae2a86bbd64801ea425b9f78f0761018660991e3160efbcf857dfbfdb01b650a9c4c263
-
Filesize
6KB
MD5e61ec170227bf15b4de07bf94d80c502
SHA178f3e7a1f80aed0be1131893830a161e343cea4c
SHA25675d9acdda42896ef5a514a93a0fb09a6d1919cec691be5665ba54b9d16d98fc8
SHA512607b7ba72c6312a74374acdb163c9714dd331defb027f1e7912ab9b735261cb01d319d3d280522067ba3ebfe10bebd9ca4db1782a5326ac5742c72c21ecf371a
-
Filesize
6KB
MD5e02bbdc5606b30475037a1413714246b
SHA1e8083aea92210ed55e256343f18f093547d9e85f
SHA2561c9383028134c452b9aa62429c9f41d448dbf730420126196a1e83a2c367b6fd
SHA5126c803775163959887b83de1ebb8a1ecdc6c2ae6e3c420268883356402369036e5ae2ce64edfaf1200903d20cef518be23060e92a414756d266d7746117a9b815
-
Filesize
87KB
MD54c1b8c171ef9a6594c93a8ec14569a67
SHA106d583bb26ea9f8b7fd1fc5baa2e336f3311a1b8
SHA25642435eeb6c119eab8df213e2eb1c22f5d52fc9a6ffb6632141a284412996822f
SHA5122e43f81f8d4828302812be024e66e47a404710fc0c0e5f15ebbcea4726a452c8868c1cdfcb2b9af95d8c660dcdc0e1f275e4b94dbd868a7eeaf2cb3ce1bef4cd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd