Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2023, 23:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cslbehring.net.br
Resource
win10v2004-20230703-en
General
-
Target
http://cslbehring.net.br
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2848 4696 chrome.exe 81 PID 4696 wrote to memory of 2848 4696 chrome.exe 81 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 5024 4696 chrome.exe 83 PID 4696 wrote to memory of 2460 4696 chrome.exe 84 PID 4696 wrote to memory of 2460 4696 chrome.exe 84 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85 PID 4696 wrote to memory of 4584 4696 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://cslbehring.net.br1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd41e9758,0x7ffdd41e9768,0x7ffdd41e97782⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:22⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:82⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:82⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:82⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5020 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3164 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4880 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=212 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1652,i,17332727866670545819,14948503545317602895,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2016
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c40410dde2ccbba833f27e1750b37cd9
SHA1e48720f88e5b7db945851117fda1548187f3d4b9
SHA2560c2f40825d4169738a2953e865b13c4db340ea1ab4b245dba138b91c0dd65eae
SHA5125b955a6c26881d654c839eea91d3fb9adb638791d5f7b9ab9f6a0dfa3d9b2ea95e750af18e52f05b7d6de46d0a73bf3b969a12d75a71e82787cb1c43809a2612
-
Filesize
6KB
MD5d3dac3fce100a8da193f68f6e165edf8
SHA1dacc43ff79b2df180063441469db6efdd779f365
SHA2564a0197f0fd02b9193ba930d9a9e25efa0140f7b50bb296f913e8e6e9abf3eb92
SHA51254f3b2f6f9b0a88995d77126b3d6583ffca8fca19c29f726c6213933b185346e6e96187650d89bd4a1e7e68e4f5c00b9928802c8fc9b0f0c850def51fb45cd9d
-
Filesize
6KB
MD5de20fc30f8a5b5998d44cb165b2e66c7
SHA1f8ef94a831e2b8bd1c0e884713e667b5a63fd49b
SHA256f38bc08d40ac98e9259f958fae49d745ecf17d31dd31177c883bafc6f746e56f
SHA5120e87c4efeacfcfdf382954e2d366e18b44c11debe7e2a5830c8fc2a0f3b2fa0427ac0cfbb7116aca508c532778b3addbaa6e9fe63f85b9ad7e7104cdfda79c5c
-
Filesize
87KB
MD5b1683f2cd20b9aa86ccefdd55e4f2fd0
SHA16f41856a2c51fdb9d00699ca81af7ad79ed0ce1b
SHA25680c7755d9e9c425bff3aa64ee95a3f3b7229908cfd4a4f043a13c87d57afb634
SHA512f75abe5e1f14c2e7179cfb42ee0254727e539a946a6f79d09fa6e4c49221cdeb816c397a799501f01a4e58fa48203fa1fa7fbfdb961fbd1b41e99aa559f2fdbb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd