Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
32s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
19/01/2024, 15:30
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fayome.ovh%2f%23%2fproj%2fhttps%3a%2f%2fayomi.fr%2finvest%2flanding%2fpage%2f18443%2f%3femail%3de459yd%40erac.com%26idprojet%3d18443&umid=3e38bc27-3148-4c26-9205-7cd76220bad3&auth=663c9af02b28e622c0295e1568a206100d47dd90-921a21286c3bb4c12f61481cdb834556c7172d8a
Resource
win10-20231215-en
General
-
Target
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fayome.ovh%2f%23%2fproj%2fhttps%3a%2f%2fayomi.fr%2finvest%2flanding%2fpage%2f18443%2f%3femail%3de459yd%40erac.com%26idprojet%3d18443&umid=3e38bc27-3148-4c26-9205-7cd76220bad3&auth=663c9af02b28e622c0295e1568a206100d47dd90-921a21286c3bb4c12f61481cdb834556c7172d8a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133501518713608285" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 3920 3516 chrome.exe 18 PID 3516 wrote to memory of 3920 3516 chrome.exe 18 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1704 3516 chrome.exe 72 PID 3516 wrote to memory of 1516 3516 chrome.exe 68 PID 3516 wrote to memory of 1516 3516 chrome.exe 68 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71 PID 3516 wrote to memory of 2416 3516 chrome.exe 71
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe05749758,0x7ffe05749768,0x7ffe057497781⤵PID:3920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fayome.ovh%2f%23%2fproj%2fhttps%3a%2f%2fayomi.fr%2finvest%2flanding%2fpage%2f18443%2f%3femail%3de459yd%40erac.com%26idprojet%3d18443&umid=3e38bc27-3148-4c26-9205-7cd76220bad3&auth=663c9af02b28e622c0295e1568a206100d47dd90-921a21286c3bb4c12f61481cdb834556c7172d8a1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:82⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:12⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1496 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:22⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:12⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:82⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:82⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5064 --field-trial-handle=1628,i,12093432795141641868,712083541099808265,131072 /prefetch:12⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840B
MD5912dfe016a0eb4147f26daa7c9e90031
SHA1bbe98d6cfcf65b5030858190e28c4f2bcd3c92bf
SHA256ac94fd2ae04ab64886b6d90ee1ae5f77015789e4748b51d7e00b9fd9d75a132f
SHA5123d473cd313b6995c1a8222490fc2fc66b23378c2d94376fb7a1d32adcf94adcce4b18f3068387d6f8c088c7e8d836010d6efff0d4765cdc3243c33d36f752fa6
-
Filesize
873B
MD5b25225bd2697d7b33cd25284a2ff95b8
SHA1298796cecc5554d01ead1fbf45117288d7d5cad1
SHA256d67e73c05310c8aad482352296ed0c6fb2d000c998273dccf44e66632735e825
SHA5128f2817a55419217cc32c7571b84b52dac66ae0eda6fa7028dc71a4cd27640c3883dc9bf117c6c544843a6db4cc509ea764272e21903a74b0945de142cfcab947
-
Filesize
6KB
MD5c69ceaea8a89cf1058ec3b1d7b5d00f8
SHA181e90a339f50f3fe9f2bebf604a3427c3106b143
SHA256b136236bd1cf3131998115b10267afea143c6b144ba0e1ba368ba7d260b9e21b
SHA51248bdb6033cefec5066a3bc56a5d96c1fe141080ab5cf9be6ea1069cfc4d084c5ccab208936311b0c973c75758a748fda53a80aa38227a78d320d8f5db87229c0
-
Filesize
114KB
MD5d17e7920861585f873de4e7d1d0b2aae
SHA122fc3ad81b39c091dc45792bcce6cbc6a9670cea
SHA256d605608f5a9580bf55eddbe515190fa35bc0696a6f2f05f7c1942ce958f95f25
SHA5120384b37843c7775789ac4eba30cf3a1d46bfbb2002701092b3e180e2497cccf95ff77edca7ff224820147503e9a2236bf6c1bd65dc23a73706206058e33b0279
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd