Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/10/2023, 18:45
231001-xekcdaea78 1Analysis
-
max time kernel
49s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
01/10/2023, 18:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.icicibankprivatebanking.com/content/dam/icicibank/icici-assets/pdf/combined-disclosures-and-disclaimer.pdf
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://www.icicibankprivatebanking.com/content/dam/icicibank/icici-assets/pdf/combined-disclosures-and-disclaimer.pdf
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133406595806498245" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 696 4444 chrome.exe 70 PID 4444 wrote to memory of 696 4444 chrome.exe 70 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 1396 4444 chrome.exe 74 PID 4444 wrote to memory of 3364 4444 chrome.exe 72 PID 4444 wrote to memory of 3364 4444 chrome.exe 72 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73 PID 4444 wrote to memory of 4828 4444 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.icicibankprivatebanking.com/content/dam/icicibank/icici-assets/pdf/combined-disclosures-and-disclaimer.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff96d1d9758,0x7ff96d1d9768,0x7ff96d1d97782⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:82⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:22⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:12⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4728 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:12⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1596,i,12504442782937040738,8710877103383893063,131072 /prefetch:82⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
536B
MD5398a53903061c79ba07d4c951518c095
SHA14e39e6db68bf62ada6e71c745c443576b978cee3
SHA2563bbc1bbc82d4ab04c4e199e3d094e79572562bb085d35900fe7bbfba76b74780
SHA51279ba7e38b26ae3e44bf726769f80c61a8baa855f4e53f5757664a5198d55d299b01cc3d603d5b1569bde728aa1e17cbabc8f30a131f201ae0147758ed57d94ae
-
Filesize
5KB
MD5902c4a80932eb38b30749539bdb4fd41
SHA1bad805b91dcdbef3e260ee6d0afc1a285e5c98e7
SHA256eae812e19777cb1826bfcfbe9df8adfb5d6bade91980ec5d34c997921486628c
SHA5121472b9ba0edbe73583fd70c07f9cf486445d6b9f9230d57d8b81c3831e54e0aeac074a973590e5685c6fd612fef8b1f803e5b574298bdb6ce6f751740309b94c
-
Filesize
5KB
MD53e7d52a21fd7c38571ef2045763afbba
SHA12031f2c34c1d0f4ec25fc705490db702616a5a68
SHA2562dd434d14ae371df251c07cc2da7d1ff2911a4d688951acf1cc04f2a45f90e45
SHA512662b9eb793b0b7c2c90089c901e5221d82dcb11c4d22191eb224f1a5a18afe5ba1f1f29a071a430e19bb030009c9928afd91ddf8a5f87b6ef5e33266a8bdecd8
-
Filesize
101KB
MD58b1935db1192e57c93e1039042eff7be
SHA1628eb4e5af1c79da56cc5030bf45f96abf262b94
SHA25634ddf4adfccaed877ba1a48cbda578255ce082c5fe3c0803b720bcbb4914748c
SHA5123d1990142ed0ed2c3947571676625d49bdfc79ac2cf4b274c71153f452cf4b8b5ba840d7018a20e871e3ffc44d849c9d54580664f495aff615b03d8a9b6925a3