Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
490s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 06:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://elzonte-lety.com/interconnected/?compatibility=cGVybm9kLXJpY2FyZC5jb20=&enclosed=bWFuc2kudW5hZGthdA==&miniature=TWFuc2k=
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
600 seconds
General
-
Target
https://elzonte-lety.com/interconnected/?compatibility=cGVybm9kLXJpY2FyZC5jb20=&enclosed=bWFuc2kudW5hZGthdA==&miniature=TWFuc2k=
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133365535331698410" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe 656 chrome.exe 656 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 1788 2896 chrome.exe 83 PID 2896 wrote to memory of 1788 2896 chrome.exe 83 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 380 2896 chrome.exe 85 PID 2896 wrote to memory of 992 2896 chrome.exe 86 PID 2896 wrote to memory of 992 2896 chrome.exe 86 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87 PID 2896 wrote to memory of 4132 2896 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://elzonte-lety.com/interconnected/?compatibility=cGVybm9kLXJpY2FyZC5jb20=&enclosed=bWFuc2kudW5hZGthdA==&miniature=TWFuc2k=1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb71d9758,0x7ffdb71d9768,0x7ffdb71d97782⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:22⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:82⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2768 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:12⤵PID:3124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2776 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:12⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:82⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3316 --field-trial-handle=1880,i,3888622738983061764,8257792576645033120,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:656
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
897B
MD58c2a8b5de453fb41435dbdc998e6cb58
SHA132739c0f1701cddcb7bb18ff632c8d0021b745c6
SHA25603ecf49a7ca0c2e06eb61ce7bb864b2b3ca2dd475663947b41e297796b29e8e0
SHA5125f7a8667821ce84e95c8a8bcff7fc7fc395c4b6c47623ab0ab36802096fc6ff8ac044619c81d95e14c6d6dc4cb96432cbf15f11db9aba937553d451f59a7833f
-
Filesize
6KB
MD57d81605b9f7301e42f160b48c4b8ad85
SHA1fde82a8cb8e6306412bf5da77ec182df219c38eb
SHA25602a55e8dd14562d37280fd68c529424e079dbd479ec3a6c40df718b83729c810
SHA51274d25b6a278dccd5db0cada3bd2f034837797ee97cfebe367b3c216216eae8c49e8fbb7eb42c554b22542eadb0c9d3fc04aa424fabd0b5e1e59d6abca12c1679
-
Filesize
87KB
MD5097c6b37e5122b2d7cb3793adf1667ae
SHA1f2250a5f6dd0103c28a16da94f3571faac47e7d8
SHA256e35c80a18bce604af0e1cf623565a43411cf3aac1d8c6517d67f3e9029dda5b1
SHA512803ae9212bdda85513d1ea5fdeec071102e673df942f27ebe29accbc83a3ff2369bd77ed7d8f46306fd5c64b4fed8a5d7f2028609260a7ad33f1671dbb7d03d8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd