Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20230220-es -
resource tags
arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
27/03/2023, 19:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.cicade.com.ar/
Resource
win10-20230220-es
General
-
Target
https://www.cicade.com.ar/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133244194822596203" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe Token: SeShutdownPrivilege 1092 chrome.exe Token: SeCreatePagefilePrivilege 1092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe 1092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1124 1092 chrome.exe 66 PID 1092 wrote to memory of 1124 1092 chrome.exe 66 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 2820 1092 chrome.exe 69 PID 1092 wrote to memory of 4048 1092 chrome.exe 68 PID 1092 wrote to memory of 4048 1092 chrome.exe 68 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70 PID 1092 wrote to memory of 2024 1092 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.cicade.com.ar/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd90209758,0x7ffd90209768,0x7ffd902097782⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:82⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:22⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:82⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3768 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4744 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3772 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4876 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:82⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:82⤵PID:204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5164 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:12⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4928
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2b81⤵PID:3788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD51d8dd5edb6fb757ccf0ce9101cb32b6f
SHA1b3cae3cb2e8ddab380d6c30faafab4cbd9e2fb57
SHA256e2e3beb941d0b13d74012260645934d72c51da9bd7a5892b3f6b3a30be2ccada
SHA51216d78c96bb9171a481dec23a1c3533d95d7c201b295c5e0fe1db92a202bdd53e4a9f3ab3f362836dec883a4db5f58da4377c192f666e7b96d63182b4d7d50acd
-
Filesize
1KB
MD57255b0870966e3bb1da24ed4f088c636
SHA1e59168d6bbbe0e163c0f11750f2f91d3c7992364
SHA256a23dc475cbf832e56facd2d31d0a48e199aed2b56a47cad5c0a597be0ce99239
SHA512129ba02b5a84d5df74481e718359e533a0a07f98b35bb0b59609a3c13c9fe530cce085094eea03d9881536433360694aaa2178bca3d3eec8171e3ea172e2033f
-
Filesize
1016B
MD5bd3385b0a0aa94c9d9e0c6d23348ffe5
SHA17cb648e94129b35123300f9001b0fa160a26196a
SHA256c1171261258864fa9a152146aa7ee59a463b1ad0911ce0a41b31443a6dee7e38
SHA512610a956629b3ad30f5fb6b6bd743eeb6630e3a0f3f34ac5a4241d46ec8037a2dcbb027e6234889d21abb08060b0cde69d4cccad9627a59c08e47b296cb023655
-
Filesize
1016B
MD580e49739c6b74230f3a15d0b32836d12
SHA15f868e02f592e960d15a5313e6ec09f5359fb52a
SHA256e30740358a7dfc1d9a4615686a674c646c0612053e4be1fc64e758c56b72897a
SHA51269216d912614534f3de328ad07e6f377e717138083126fa0e1c1b81f300325a6152c67e30de2bd44676ca720e685dacf79265ffd877d688956b7a756b78b5d1a
-
Filesize
5KB
MD576769cf3a01e323a082225491f8dfc82
SHA1e1031815ee37298a9783048cd39266672d277f63
SHA25612b2a47aa854439a4e43ffde73c26702341177ac210f710e11174d40670b3f3d
SHA512e624944a10d42548c1e946e8238c358e5be49f855151d23aa6b8aa64b396651f10117389abf878c16abb44c5dea192430ada0dc33834e323f03fbe059ffafdbf
-
Filesize
5KB
MD56691391f15590d86ad10c8200f38f638
SHA1d3de1094fa5714589128dad0fc3edccb7c6caff6
SHA25644243c5912152161fe9d191b45e8a196f1422ea9662ad725b589538dad7168b6
SHA512970a097c5e7212c66058a03be5fbb4e459d4aa400da704a41551eac1fb77c598a56102c09b61c8e999b679668a378b1d68125a1e59057f96c88659c07f7edb52
-
Filesize
145KB
MD525ce5c81e36158ba909df27e195805eb
SHA1777216034640c5b97bdd14b4a4a796e257fa9e6b
SHA2560f12c29ca49b76caffa1383c01b90b77f8c94dbc0e468ad5f9fd9fb90589de54
SHA5127ef53c185fbcfc23c3fa8adf644a4babf6d49e5f39c3c6f980226d01debdacc2f4220af03795c8a4b16ab32673b579294681837b1367d05944b29359852d31a7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd