Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 03:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://2023-access-myrefund.top
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
http://2023-access-myrefund.top
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133372349321476364" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 4024 chrome.exe 4024 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 3324 2312 chrome.exe 82 PID 2312 wrote to memory of 3324 2312 chrome.exe 82 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1464 2312 chrome.exe 84 PID 2312 wrote to memory of 1072 2312 chrome.exe 85 PID 2312 wrote to memory of 1072 2312 chrome.exe 85 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86 PID 2312 wrote to memory of 4940 2312 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://2023-access-myrefund.top1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd9149758,0x7fffd9149768,0x7fffd91497782⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:22⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3424 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3980 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1692 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4348 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 --field-trial-handle=1876,i,6985464194603345732,2235285796820202970,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f50bb64ac88215bf3551693a7e79c3fc
SHA11a540fbe5f1cb4366a5402bcebe020a6948d3479
SHA2562c9af95709c9077028e6f8941dd243ca38153a0b9a8b713f54b72dec9b4d2419
SHA512ef77727495db783f68fbb78f4621f843a7b46f9dfa44b8ed3c23647410bfefd32e7073f09d677d1dba412987a728f342a0c27185f0e94ca68afe082aa558b254
-
Filesize
5KB
MD550294ea10266e0d255025337f700d706
SHA16a87ca301c4ad14f0514c9eda9f20ec56a40016c
SHA2563de628fe4191a974e2d19407284911374fa175f6b1906c798a448491e08b96bd
SHA512d93cb1bfc409390723095d9f71781b5b5244b9c39cf9d12cf6ec36f39e52e33f77f212dbc64b8d5ca8f85e7e33030c344eabd2470b556a4d1016c4c6bf825cb1
-
Filesize
5KB
MD5651d1d02d3d41ef1690204ce4de4e1be
SHA1d27a962734785b3cc1d241ee6dd46a1ca9e10a8f
SHA256d074dd634efd11750b540b71e90e1788ab8b91ebaede5b53a42c2cbd976d777b
SHA51245ce496c083558932dcbe471a283fd3cd24d6d1610c91d9369df61d84cd107a4fda69721a7e11181e10de32f823d86779b2e94b69a3023ddc63e21bbe61dbaca
-
Filesize
87KB
MD5bf910beb75434b427528261d80f8f8f2
SHA18687fcf96bc1c386a468aa70156f34d03d39f114
SHA256c7df8c8ffc161579ebb0ff1882a8fcbc6b143387b790c8912ee69522ad0de374
SHA512cbbc187ae02fc41a5749d8431fed76bfe328398dc9d19a3892f5cbd686ec5bb727ceac1459ca071f9ad979f7ed04ee3b1ffda2748acb60e435a0d96ea9e2b771
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd