Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2023, 19:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://l.ead.me/podhc63tv
Resource
win10-20230915-en
Behavioral task
behavioral2
Sample
https://l.ead.me/podhc63tv
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
https://l.ead.me/podhc63tv
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral4
Sample
https://l.ead.me/podhc63tv
Resource
android-x64-20230831-en
Behavioral task
behavioral5
Sample
https://l.ead.me/podhc63tv
Resource
android-x64-arm64-20230831-en
General
-
Target
https://l.ead.me/podhc63tv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133397972057312748" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 596 chrome.exe 596 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 548 4300 chrome.exe 23 PID 4300 wrote to memory of 548 4300 chrome.exe 23 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 4972 4300 chrome.exe 88 PID 4300 wrote to memory of 1496 4300 chrome.exe 86 PID 4300 wrote to memory of 1496 4300 chrome.exe 86 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87 PID 4300 wrote to memory of 4168 4300 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://l.ead.me/podhc63tv1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe45b09758,0x7ffe45b09768,0x7ffe45b097782⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:22⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:12⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3268 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:12⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5396 --field-trial-handle=2060,i,3533862379285121944,14354162210318914045,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:596
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD53d07e903adb6a805bd4abca2ef980a90
SHA17cc4b29e4e3be101052e46f84e3a5fc1d07e2e9f
SHA256963689beb3e89b47e0e552fa635f4d438b10280e7621f36da65661fb2a52df5b
SHA5126ea55af0baa8cf307489bae13ca8a218564e21449901456bcbfd3223ddfe6de448e781c23513875a7388dd06bc207bc7e0291b0e92c80029382bee59b987f67c
-
Filesize
3KB
MD54512de505fe42835e6c8481acfcf3c32
SHA17b13cb959ade006311599662f15d22e2c881d2f0
SHA25620711d14e2f36c768a482dfeb79274b5087c9c797760ffff7cf660d636e5719d
SHA512c378e0dbab3c01898aa5b50bc67ee15c6a0ad05f5998b418cd6a87e6c6c1f55e73796da9252efe2a513981d8d0a66a73c7dd5153aded22983451024fccdecfab
-
Filesize
2KB
MD5f98da7a727feba5f95bcd2c79ebb91f6
SHA130038b2faf521d071cd79b3362a50e747188a109
SHA2566f15353eff7d3ac6db1c23e975f79d88671f838eb9fe24341fa09a6b6ae6df8c
SHA51220c6c271ed94dd8ea454442af1dab0919bcb50344d722d77b2c5604b894fb8382f3030067d1a5823e0cab4ea125a20bcfd5f6a15d1b4c06aa213fc6fd313eead
-
Filesize
539B
MD5dc6aa4a366569da4f547c29f72832963
SHA1cb0f1d13b3e0d8d9adaf9add68e32658e4cfd3e8
SHA2567b9945288a84fdf45db1b51236430b6abed4c6b5f7b0ec80fc4d86f0b656aaa8
SHA512322f9b91845374b5b159f86e3afbe99a6fa42969921882a5a75a734fc584556544770680da3489be631d0b0a8db4545805d8df3a0caff20642f78ac938ba41b9
-
Filesize
6KB
MD5e7f76fa9d025359d6e2787d678db23ee
SHA1fdfd6ebb772531a22cf1dd9bf32739043e8d3e31
SHA256aedad073c3ab47fd82826ee87230e0b7aa980541442fde1d650c69ec0f528b75
SHA512ebc669a8a2021d97f9c649c57ea3f888840191f420b00e4e2337f1f2d0537005a8b68d5e14430092a8c6bad70d00520940c9eb663234b9f2dcd4b6d3b56a9da3
-
Filesize
102KB
MD52731de4b5b7eacc14e5fa96d8d1797c3
SHA1d7ac3406306e4882e06f000350d2fff1ed2ebab8
SHA256f214c64ca12630be511abc03ee734d44245253f87abe161ef2394d6ed0412fd6
SHA5122b847e0022c12ec84b6ddbe22ab4defaf84f9fb4d05cfbc8decd00d03350f5ec36bc0605ef5fb8636e9bde21133386aabd09a53165fc078f720b6d01e8d0a7f6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd