Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1URLScan
urlscan
1https://www.indianau...
windows10-2004-x64
1https://www.indianau...
android-9-x86
7https://www.indianau...
android-10-x64
7https://www.indianau...
android-11-x64
7https://www.indianau...
macos-10.15-amd64
1https://www.indianau...
ubuntu-18.04-amd64
4https://www.indianau...
debian-9-armhf
https://www.indianau...
debian-9-mips
https://www.indianau...
debian-9-mipsel
Analysis
-
max time kernel
122s -
max time network
152s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
20/04/2024, 21:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral3
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
android-x64-20240221-en
Behavioral task
behavioral4
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral5
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
macos-20240410-en
Behavioral task
behavioral6
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral7
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral8
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral9
Sample
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Resource
debian9-mipsel-20240226-en
General
-
Target
https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE\""1⤵PID:484
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE\""1⤵PID:484
-
/usr/bin/sudosudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE"1⤵PID:484
-
/bin/zsh/bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://www.indianaunclaimed.gov/app/claim-search?utm_source=Adwords&utm_campaign=IndianaOAG_sammy-terry-april-15_20240408&utm_medium=Video&utm_content=sammy-terry-april-15&utm_agency=PG&gclid=CjwKCAjwz42xBhB9EiwA48pT7wtgVqVsXj78Yjf6YJCs4c1bGUg_LIDMfQi6b4Acl2GoGLGYk6ep8BoCSuEQAvD_BwE"2⤵PID:486
-
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:491
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app1⤵PID:492
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:528
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:542
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:543