Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 18:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChCx3i0yT2VT7R4IK33uS9-LEI8N%2F/1/0101018b24b212ea-41da6f74-9524-4329-bd79-be773463c635-000000/eF7hpEUXWeM2b_Wsu-9JQm30sSaI0oJSTBFvXSRFM6s=322
Resource
win10v2004-20230915-en
General
-
Target
https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChCx3i0yT2VT7R4IK33uS9-LEI8N%2F/1/0101018b24b212ea-41da6f74-9524-4329-bd79-be773463c635-000000/eF7hpEUXWeM2b_Wsu-9JQm30sSaI0oJSTBFvXSRFM6s=322
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416087068234329" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 764 chrome.exe 764 chrome.exe 1932 chrome.exe 1932 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 764 chrome.exe 764 chrome.exe 764 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe Token: SeShutdownPrivilege 764 chrome.exe Token: SeCreatePagefilePrivilege 764 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe 764 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 4112 764 chrome.exe 51 PID 764 wrote to memory of 4112 764 chrome.exe 51 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 492 764 chrome.exe 89 PID 764 wrote to memory of 716 764 chrome.exe 88 PID 764 wrote to memory of 716 764 chrome.exe 88 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90 PID 764 wrote to memory of 4404 764 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://a.squareupmessaging.com/CL0/https:%2F%2Fsquareup.com%2Fpay-invoice%2Finv:0-ChCx3i0yT2VT7R4IK33uS9-LEI8N%2F/1/0101018b24b212ea-41da6f74-9524-4329-bd79-be773463c635-000000/eF7hpEUXWeM2b_Wsu-9JQm30sSaI0oJSTBFvXSRFM6s=3221⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccaa79758,0x7ffccaa79768,0x7ffccaa797782⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:82⤵PID:716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:22⤵PID:492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:12⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:12⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=896 --field-trial-handle=1876,i,1564651582431188586,16506029241723207585,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD55ff389db8793432ecd4aa5c5921ccfe0
SHA1b4bea0f876be20f19323585d0b8f8cf1e756b3ee
SHA2563813605d9b7980f4978b7f10a22e7ba389d3d077a5a1b8d0502ff3cf732a7745
SHA512ad9fb25a741e1632937b6cfa44a58aac44d9a86d60deeaa131a5f84e095c3de1fbdb311f4a49a69eb0db3235ec805a15afcf969ca8500d51edef07211d255d58
-
Filesize
2KB
MD5fb4d4d3e338e494ea8d4c85b3cc932f9
SHA18b0db8cdaf4c54937c3bd800b0523744a80cbf1f
SHA2566485589e4714e4245783fabeb7c3cae2bf5a22c9aa4b8783ae7faa6bcc225123
SHA512da21849855aeb5d7badfad9f13cb826231ad4d7e495c73339c1906916c8a4c67cef347a901cf1923f2088f0414a72e91d60c7b449466670a8f598f98cc580afe
-
Filesize
1KB
MD5cc6ecd53315741c9e553248d1deb654c
SHA18d07bf201f00e468441d29f003492466020e11db
SHA256b248d14ef2a52c4784e2eb4c7021798766a26a6de516ab6c71364e7bb42368c5
SHA512fefba4565a80c66f587512d0e931c6da522d904497a563ea35a24eee8378f77987d2e7fd5d04b9f8e1b6f51c8025cc3e9a84db25f3ee628d8775cce19987b664
-
Filesize
1KB
MD5109851b81453dcdb8250a723866acbeb
SHA15b1b8adee572e634dcd309aaefa8c8ed0bd8e684
SHA25674f729b94cc3bc8bf9b7ad6c2b0216e12e08d4894039a29867a1ad01dfa23c02
SHA5122cadaec4c9f90831600b13d3521601edb217cb26cb17029e4b22fe111bc793ca5a949a7bde66af39e1173ac9be845d4d3be8b0857d9ac4f48fec35d1e6f2baa5
-
Filesize
6KB
MD522804d671ee508b6ab600b05980ada45
SHA10a3c7b3bed0208886b7f99fbf5c7511a28d02c74
SHA256c930686c5db0846a878293e590977d9862144a8e516355a24bfe38570ec21e6b
SHA5128dfbcb2fb20cf4111007c3ce532e3109696158e7a3b3f8f7f7bd27b4cf8397ef6c2b9992c04fc72d26c53ae51c6282bbee34132dbda942159428010faa986247
-
Filesize
6KB
MD505100e2005f79122997e9ef2ee52ab5d
SHA1e3ddbf665faef61ba7116729df921cd924189a56
SHA2567a1ceaa535618c02db15c525d96349aba76037c1bba6cbeb9b41a72a82a429ab
SHA512f4a0eca82401754367a9de19828d4f8b4c4cfb47023d26fc8efab16ea0ebd59e0eaf5feb3c8d4b2ff33366dc1e377d4b01a526e15b1e75be6291e416ba4d5dfa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5b45f45-0f9c-44f4-8d8e-5e7eee65e53f.tmp
Filesize6KB
MD5e0fa97038a361a6024a6d5a286f210cb
SHA1aa9edb6f23ccb767075b71962319062ff44f4a19
SHA2560205939715a9b37245cfeff01385322ad9b8c8fc6dba4ed7f2a960f385722dd2
SHA5121ee20f53e12e9d6a3865f520970f7f3e2193b320421c23e514f1fdeb92348142a54c8df42236f837208f290eee62234e456a88d21d8fc2a012efb5dca55f8d35
-
Filesize
101KB
MD5b0e702fe0b7dd55992b3a519d1ee614c
SHA166fed4b85094e844e9755672f81ad8f7f7519342
SHA256467ba7ca51f4bc4b40b5e630dcf853d1d38b846e2cf89e6bea21f691c5909228
SHA51279c639d732b9aab0f723ab8a747b827fb2ac4eb48bf997a978cd9f75bf51a885fcb028a763d57944660b81065aa335f93aaeb8d956d3995a4d9f3e23b3b0b54c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd