Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 17:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://jardindelosangelesdylansac.brazilsouth.cloudapp.azure.com/
Resource
win10v2004-20230220-en
General
-
Target
https://jardindelosangelesdylansac.brazilsouth.cloudapp.azure.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247564265004030" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1044 chrome.exe 1044 chrome.exe 2944 chrome.exe 2944 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe Token: SeShutdownPrivilege 1044 chrome.exe Token: SeCreatePagefilePrivilege 1044 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe 1044 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2724 1044 chrome.exe 86 PID 1044 wrote to memory of 2724 1044 chrome.exe 86 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 4804 1044 chrome.exe 87 PID 1044 wrote to memory of 3832 1044 chrome.exe 88 PID 1044 wrote to memory of 3832 1044 chrome.exe 88 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89 PID 1044 wrote to memory of 1084 1044 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://jardindelosangelesdylansac.brazilsouth.cloudapp.azure.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06cd9758,0x7ffe06cd9768,0x7ffe06cd97782⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:22⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:82⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:82⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:82⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4632 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1020 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3140 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=828 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4700 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4848 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3344 --field-trial-handle=1708,i,13900461575426239334,12467673535580383124,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3312
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5dddf49a61187e904612c6055810f1ea1
SHA133ad54bcaaee22b7b29f62ca5161cdc4bcbcc425
SHA2563cff9fe03448c8bac6cb3044b27d962b8cc323291c8e79a30618af1d1f54f5d7
SHA51205571eaedc91d77fb139e1782cee5563fb4cd2501310da10d4935a35bf17c8837e6c38005db3c882bc959ec7857a2162c360306deaaac4c81864f407d61229c1
-
Filesize
6KB
MD53ca399b7a5d9000191c10a5d4f665bce
SHA165364f67d121b5f26e77a0f6fcd6738da8ec62f2
SHA25680f8b7918cd6bd29ddce7d7da35b73a7d51be2f857792ab767367db108c7b912
SHA512e8aa9564aaa622b4d909906772923aab8a34d5e6e3e5fa6d72f7a62c9ef052eba120aec56366a42daff10ca96e5f1ae51101b79804704e5b12f5fac76c846027
-
Filesize
6KB
MD5f0f60d62318b27e1d91021d3d9424ae8
SHA11e773fbd933a13d1aec6d5cf6f4fe4934dbdbd68
SHA25635513cfbbd3110592e8d9f959cac46e9bb529844100d1db0b0cd203a436b429f
SHA51291d8c4c139d864883c9f09ceb3a5fad5ec772066186cc0427ed0a461159e951b1bb564d0d876725921aed71cffeba305f9565fd256b30863257d75e298c8512e
-
Filesize
173KB
MD503dd3ac0e221be2955dcaf534b33fdb1
SHA1f04ee7da7a1407dfd6360e6bed3d4fca9ca0af94
SHA25616e85567b4adbbb288a20c0ad3957eff0f8420419d2742487919c38c5fec2ef6
SHA5122527c05394fd27cb4f898b1f68b914d7d548cc485db156214f87c4ab39e9c15f949d41607bf640a63db40c791343e71b6a18b7af4cbe1bac542c46525efa1294
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd