Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
209s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2022, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
Don't forget to pay the tax within 2 days!.eml
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
Barra_2122f2d4-740f-49ea-a4ba-47278b732cf7.png
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
Logo_CAMPERO_6d51b5b5-ba21-42a3-a9f1-215ceb1330db.jpg
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
email-html-1.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
logotipoCMIparausoonline[1]_63a40cf3-d8ec-4448-9bd7-95e668b2e305.jpg
Resource
win10v2004-20220812-en
General
-
Target
email-html-1.html
-
Size
8KB
-
MD5
dac7d822a7be3c0548142623bb21a763
-
SHA1
42e6c69c56b0b4fb4ef7fd27c0b2e2fa764c2605
-
SHA256
b9f18f5185a6d79e6d47831067fe3c23de4c9ace83f2bb6ca088b5bfeb0cc6fd
-
SHA512
72437c66b5001d00bdc25436d0ada0651da718cc18a44f344a154238aff6cd80cd480db51ee42655bd4c60961f8c35d0930d13eb68e05bee1170b90fba3a360b
-
SSDEEP
192:oxMwpoVRqYMjIkuk7iw1Ck/+aPafk2RQd4DIwNw:KURw7dbcQl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 3976 chrome.exe 3976 chrome.exe 5044 chrome.exe 5044 chrome.exe 4216 chrome.exe 4216 chrome.exe 3400 chrome.exe 3400 chrome.exe 1276 chrome.exe 1276 chrome.exe 2764 chrome.exe 2764 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe 3976 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 564 3976 chrome.exe 81 PID 3976 wrote to memory of 564 3976 chrome.exe 81 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 824 3976 chrome.exe 85 PID 3976 wrote to memory of 4964 3976 chrome.exe 86 PID 3976 wrote to memory of 4964 3976 chrome.exe 86 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87 PID 3976 wrote to memory of 3484 3976 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa038f4f50,0x7ffa038f4f60,0x7ffa038f4f702⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:22⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:82⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:12⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4340 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:82⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4988 /prefetch:82⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:1040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:82⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 /prefetch:82⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=212 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,16360786339773882862,17888633335212914971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:82⤵PID:240
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5024