Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
186s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/01/2024, 22:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://aus-taxrefund.pro/access/
Resource
win11-20231215-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://aus-taxrefund.pro/access/
Resource
android-33-x64-arm64-20231215-en
android-13-x64
0 signatures
150 seconds
General
-
Target
http://aus-taxrefund.pro/access/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133494003365856072" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeCreatePagefilePrivilege 2592 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 4848 2592 chrome.exe 37 PID 2592 wrote to memory of 4848 2592 chrome.exe 37 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 3928 2592 chrome.exe 57 PID 2592 wrote to memory of 4976 2592 chrome.exe 56 PID 2592 wrote to memory of 4976 2592 chrome.exe 56 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52 PID 2592 wrote to memory of 124 2592 chrome.exe 52
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0x80,0x10c,0x7ffc72af9758,0x7ffc72af9768,0x7ffc72af97781⤵PID:4848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aus-taxrefund.pro/access/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2132 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:82⤵PID:124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:12⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:22⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:12⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3156 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:82⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1284,i,15232256191243491006,341341093346669577,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD51fbb39b55c460581d32c3deaa20ed170
SHA146a5ecff5a7b1be4d93d7eae24cb55911071dd74
SHA2564a5d588084b8f565bc7683dc35b16626b26ea4b947e15004382d831eead0967f
SHA512ba5bf2ccaafa67deb0fe7c87fde95a9a1802f0c6495a173b7f119e1e8b17587ff1fbee4330d920dc75d05ea4e429344d7f8260d8ad27eeded7d6cd5371606a74
-
Filesize
1KB
MD5aee4d2a63b2fbc04ec27f2a42f851f87
SHA12b32ee27cea0c9344e2adbad8c5c74c25dbab963
SHA2562069e4cb49e516abed9bbc0f8251b7142f7860d31235c88a2131bed03dc7b297
SHA512491971d730a738d2bda58995092a882fa44e3a3dde5820807b6e82ef9adcf35e56af0ac889a4bb0c7ce7c3df1d303b082c466ad867c201f51d555b8af9899329
-
Filesize
6KB
MD529d9974900a3ddc9112099efff782c1d
SHA1d1da878f587f540c117ee3dd1ab5af7f6cd69a4b
SHA256c59d08989702d8accc2553089be541e08f2c0a1a0c889b72dbe28decd6743f02
SHA5123aa9fcaeef727b2638346bae78923741edba87e8e376ed8effebc34bbe088b1fceb2c11b994d6e5eaf4221ce48b21965508fc9373980a33edda6e69436503a21
-
Filesize
114KB
MD5616c994d3ab21361c73789837e0b646c
SHA1f78f5202a5c19c778b3fa3ff802c4decd0f57d57
SHA2563566ce22988d8847fe7226fa8ef8da6196b42629c6d661ba5393922c9ac1d73f
SHA5122fac1b182336e94230b2da37bb7ed29b601f53103812effeaddbeb2735c47aadc46fb504f4f32a4fac875e5da58192f7f6af778cd2c9f73977206c97c953d5f4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd