Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 09:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://v17454pk.r.us-west-2.awstrack.me/L0/https:%2F%2Fprofile.autodesk.com%2Fsecurity%3Fmktvar002=5902199%257CEML%257C%26utm_source=notification%26utm_medium=email%26utm_campaign=s1_phase1_authapp_v1%26utm_id=5902199/1/02010000qmb0q616-5oh17v9a-uhba-5do1-k1in-e1g6hf6limo0-000000/2584i5fCtaWD8yUoLZbVQazUHuM=335
Resource
win10v2004-20230703-en
General
-
Target
https://v17454pk.r.us-west-2.awstrack.me/L0/https:%2F%2Fprofile.autodesk.com%2Fsecurity%3Fmktvar002=5902199%257CEML%257C%26utm_source=notification%26utm_medium=email%26utm_campaign=s1_phase1_authapp_v1%26utm_id=5902199/1/02010000qmb0q616-5oh17v9a-uhba-5do1-k1in-e1g6hf6limo0-000000/2584i5fCtaWD8yUoLZbVQazUHuM=335
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133371697797559374" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 2400 chrome.exe 2400 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 1444 3332 chrome.exe 83 PID 3332 wrote to memory of 1444 3332 chrome.exe 83 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4636 3332 chrome.exe 85 PID 3332 wrote to memory of 4812 3332 chrome.exe 87 PID 3332 wrote to memory of 4812 3332 chrome.exe 87 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86 PID 3332 wrote to memory of 2536 3332 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://v17454pk.r.us-west-2.awstrack.me/L0/https:%2F%2Fprofile.autodesk.com%2Fsecurity%3Fmktvar002=5902199%257CEML%257C%26utm_source=notification%26utm_medium=email%26utm_campaign=s1_phase1_authapp_v1%26utm_id=5902199/1/02010000qmb0q616-5oh17v9a-uhba-5do1-k1in-e1g6hf6limo0-000000/2584i5fCtaWD8yUoLZbVQazUHuM=3351⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa83239758,0x7ffa83239768,0x7ffa832397782⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:22⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3616 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:82⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2592 --field-trial-handle=1896,i,18222719134097130028,9007699385717381594,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD59938d50116241dd4ec513a4a9ad88771
SHA15d2a68df97d7cb46bbab66e9e8b13326668141cc
SHA256ca57c668e8a049539a555ffd55367e1f1f69c3ca5c045707cf67725539e6e99e
SHA512cf6a75e131b6a0b91e1f09d4580773e72b6a150b82dc9172b9c76c9198f6e63d6c1738045c79ca1cbc1f55970da58487319ab40e2710b89da69b1f55fdf9b418
-
Filesize
2KB
MD5d33952a91357a7802434810581a68409
SHA13f8f8725f8cb400af7b48bdb2e3e7a04fd424fcc
SHA25618168e219619bd81bcebdef8c2d00795568a471149b64ad0a94eb624fc001ea6
SHA51299c0aefe745312145374132d51445b8096cf7a34e32820c049f39fbf22f2e8d498de243e248a3f6cee054ec7149298d9498e2cf561617b3d942fde6d6b03484b
-
Filesize
1KB
MD5dab1673d0bb9e453ede967f4e7458ecf
SHA19495bfbd88a302e70ba50f66ac7a4c5bbd6b939e
SHA2561ee742d04ef64095b65d7022e43a92a34225b9408d57c9968aba4f52f1e85867
SHA512ccfb6409aae5e5401d426c522b8d00f93299e1a92c5da22283cf346166ba350c67e28896e8eac161771e5f68661cc247621b7f8d3da4e2ec906e8a415cfc5c9c
-
Filesize
6KB
MD51c3834853071d31a57c5ba16d00b21d4
SHA100640998698eb800a1ba8a6c2898fa9e73a90cf4
SHA25637dd90ee4d875a882bd4e85a8f7cf8ad19c1715dccdf98d43939e898551b68e2
SHA51222e40cda3641b1dc436d3f8e7c7a51993d7db4d70dff67ca55e17736bee62a01eecbf7b08a23fc5c4f6b0702ec71c8182bc735f3b0364a1ba45e710741a552ca
-
Filesize
87KB
MD56137beb3b8ff91776a2b16368efca104
SHA11f2f18af890e6535e9f73ddeb755e110ba09be1c
SHA25617c5e91709ce243e6edcc03171e7755ef5d07cae0c23d4b403daa3c741f33961
SHA512e4664173cfa7b250f1672fa1450dc76f9ff30eaa80de8d665bb32812d96cda3a2e281fc7e6cb11d9d53afcae762283a35c2147f5639e19e2e62e481839f0d181
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd