Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 02:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fbmdhs.org.au%2Fau
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fbmdhs.org.au%2Fau
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133394777967541419" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4548 4336 chrome.exe 86 PID 4336 wrote to memory of 4548 4336 chrome.exe 86 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 1592 4336 chrome.exe 88 PID 4336 wrote to memory of 3444 4336 chrome.exe 92 PID 4336 wrote to memory of 3444 4336 chrome.exe 92 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89 PID 4336 wrote to memory of 412 4336 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fbmdhs.org.au%2Fau1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca45a9758,0x7ffca45a9768,0x7ffca45a97782⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:22⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:82⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:82⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:82⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:82⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5140 --field-trial-handle=1848,i,16736108555882145010,1781770112142917110,131072 /prefetch:12⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fd1160eb6216e4aada50431dd8e6036c
SHA1377c8c2e7efc2ebaf54a04566d9c9d32fb8ee953
SHA256cbdbff81baba75902a2c0eb0d8f170013e6606b027b9fa51a19e2b7c5c3d7d00
SHA512658731a63327fbf6470b800b4b7535f60757b659619d8d496c716974ef6a16e9b6ae0b191780140d171035f52129a83e0bc6f40969168cf27b9c6d13727ca0d1
-
Filesize
706B
MD57a9dc19e28495411ab1ff659b7951ae0
SHA17c8011d6d2e2e4f13a891315cbaa9f086c96baef
SHA256ed77955f9924b4ed4caa9ccbf4d969581e8a2f2a1ecdfa64b66256cf47c6b430
SHA512ad3bae3a5e09dc2e1abf830885322e55d723de56c7895d3f80cc64b17b8a963d01dc65a9f78b1b66427ca600914ac745fe5983fab8c5c7aea01ad08fe52c6d51
-
Filesize
6KB
MD52a0544a0a663890157e62034ca412fb4
SHA169d53921b05c0f677c60ef5c8d174e5737040b5b
SHA25671455b3b9698a0fb2bc1f80c75ee7f6ec1f83f1f884844c2270367ecd4c95af3
SHA512356f46737a6e6fe3efa58e902f52227e941f433a05f20f3db2ec51db381949d7953865f2c0ff662e140b217b96573a2b6c89da80b97ba09d64d264ab5a6c48a6
-
Filesize
102KB
MD5fcfd85e4ebdfa5d042f8d452cced7cdf
SHA12707db279381dec6fc0e47016987a70eda1235ce
SHA256b1b10a9c67801439359db345ec7d75ef155d18b7dca4413c09f263e2320cf80d
SHA51256d650ca6d868cb444bfeabf54982b0e226ce046d3bf37272dabc17b570bdd75c93ff82232fd1f25b45937c0438e8218dd862be782f603472ad54f6c4451b9a8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd