Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
21/09/2023, 19:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://l.ead.me/podhc63tv
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://l.ead.me/podhc63tv
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://l.ead.me/podhc63tv
Resource
android-x86-arm-20230831-en
android-9-x86
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
https://l.ead.me/podhc63tv
Resource
android-x64-20230831-en
android-10-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
https://l.ead.me/podhc63tv
Resource
android-x64-arm64-20230831-en
android-11-x64
1 signatures
150 seconds
General
-
Target
https://l.ead.me/podhc63tv
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133397972068136486" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 768 chrome.exe 768 chrome.exe 1640 chrome.exe 1640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe Token: SeShutdownPrivilege 768 chrome.exe Token: SeCreatePagefilePrivilege 768 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe 768 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 4396 768 chrome.exe 52 PID 768 wrote to memory of 4396 768 chrome.exe 52 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4772 768 chrome.exe 73 PID 768 wrote to memory of 4452 768 chrome.exe 72 PID 768 wrote to memory of 4452 768 chrome.exe 72 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74 PID 768 wrote to memory of 3784 768 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://l.ead.me/podhc63tv1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc84569758,0x7ffc84569768,0x7ffc845697782⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:22⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:82⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:12⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4552 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:12⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3832 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:12⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:82⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:82⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1748,i,18056522262510437005,3239910686083636035,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432B
MD5aa2aa401d2d81a5c509f572683ef3f70
SHA1ea76a1824bbbf349f0474cca55914bd2f54e8122
SHA2563e3dbbd82081928c8d107630a557a9747499f0f8251a506aab1caaea8d5ffbe6
SHA51262e0c66f29544ed4174c8159ca4e6fe86bcdbfae412e26db9471799ae40282dc456251f9bf279d23671a2826ee33af2fec77fa590c6e92fb7d973299b0ce6414
-
Filesize
2KB
MD5ba2d8d344fdeb63d8c71604aefe47d7a
SHA138f8e05c83f9d56e280095ec6f746bdf44e597d2
SHA256d9e72d4b5c06d9929eefec4b073350f33291b6fd4f26e9b9aea99489c22f37c4
SHA5124c6b5cd3e0271c6bc0bf1e36534d94d977320ad2973c23b729f9e2fc420545315e7506347142add13cc85bcec5182db7a6218788409e4898bf4d5616a5394c58
-
Filesize
539B
MD50ed6c3a4b8aef3d6505bfc1a1e350eb3
SHA1f5d2c2a7d82a6a2f96619871e12a7de99d1d91da
SHA256c304f2a15cd42e7ce09315ebee237a43358a5a8d8b1020de2785e29bbfbcd59b
SHA5126ea2dd4dd70a89f961658356331bc227afe3e764aa49292b6f2cc726bd16138421f51bef1aec631c738bcf7e90c492c05fd9421fba402ce9dd205c5eb9950008
-
Filesize
6KB
MD583f04367b21924e4bfc1c8b02a300114
SHA1e9f75e1ecddf2a5d2c0209522d1d8a18c7fa8d66
SHA2569f7ee4890368893b11fda6a9bd77d06b0cae3caf4d9238bb79a1316f9adeb1b4
SHA512da37dd7f2ee05f246c3ba71b85758b96aa56427355162d015e86b4a5ec9b140b7338278463daaadc587adf8e14c4b0ba37c5903b0fc5d35b6ebb26dc96ea5e40
-
Filesize
6KB
MD524b841f360ac9c47b88fe47fc2a70cb6
SHA164e058b6f4c8aafc5115afb0869a5c9e68528092
SHA2567d6556de7936f0402481d642a724ab25edcc3eee1539839438642ed6d3763295
SHA51234975754ea66111f7ba5c45015515917a5500222af4c2d5590edaf172241bb0596a9cdd69b78f376077e8b794a6d82870dfa25804a8b203ded254321a05e00a7
-
Filesize
6KB
MD576335041e4c58dabf8945b3391d18bbb
SHA14f563cc2243d4b1f8dd21d37d093165f82165a40
SHA2562a895b18855daf39e9585b6634245e178a125d99693ff18628cf7a0cd6a27e6a
SHA5122e85568c743e3fb4675ac67913297600e9026c1aeaa4671301bcb420c357a1526e62b3fb5494306f16c9462c0f16b1faa7571933a0801de4e51ec760900cd58c
-
Filesize
102KB
MD509d4bb3549872d35558a793898f3f044
SHA1224f45bdf28654fd8bf11a03ca9d7ec3fb59ed8a
SHA25654001eeecf4d0dba941269bfd3f06e68399398709c0bf5358d4a640cd5a2ce06
SHA512445320b1b61b4f16e4483bbd9a51448388bb5717d0a90fd3a7de536d3ebfcc1de1e3a7f201a728ca7c5e2374fcd861cd28de37150436b9d8c8e355b45598635b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd