Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 14:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://servidor.ie-i.site/WIZlNK.ES/app/lndex.php?79K0078H097k4E219&contextType=external&challenge=?0ab5ecbd
Resource
win10v2004-20230915-en
General
-
Target
https://servidor.ie-i.site/WIZlNK.ES/app/lndex.php?79K0078H097k4E219&contextType=external&challenge=?0ab5ecbd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133407320156106423" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 1448 chrome.exe 1448 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 4092 3060 chrome.exe 41 PID 3060 wrote to memory of 4092 3060 chrome.exe 41 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4580 3060 chrome.exe 87 PID 3060 wrote to memory of 4600 3060 chrome.exe 88 PID 3060 wrote to memory of 4600 3060 chrome.exe 88 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89 PID 3060 wrote to memory of 4928 3060 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://servidor.ie-i.site/WIZlNK.ES/app/lndex.php?79K0078H097k4E219&contextType=external&challenge=?0ab5ecbd1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec4a09758,0x7ffec4a09768,0x7ffec4a097782⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:22⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:12⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:12⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:82⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 --field-trial-handle=1884,i,8932853060650261289,7564775460534172304,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5da07721ae85a7745964fd3f14c21b6ef
SHA181db72c0db101e0660e3ee2bb40af49ceaf53c27
SHA256b8d0a3e113097418d7dc2ff56bccdfdc707fdf61f8b1de6c104d900383aaafc6
SHA5122f19d5f16bb7561dc54c66131e02468d5356b8456caa4dfd43970f269c88d0cb0b310e61deccf2569436a289925e026ac12582a70fd251e5913718efc64f358f
-
Filesize
504B
MD51b67c78cd32d4af8f4ea161df95f1a64
SHA1007cf403ecf2585244072f8a1f1322c1d118e8de
SHA25647c48ab64d1b1e506f6e0667fb801e21b4143aab5794880554360898fe3ce230
SHA5129207e5e3cf99f15b63f634a0be403681b7263a32604832178b1cd5a8f3c48a462d7101fa088c6329c00da1c4700caf31f8f6b506f1853f15986bcdebf4070b56
-
Filesize
1KB
MD55c09e8a819eadb4bef106bd6f94f2f27
SHA1a87e95dfae99f446d1f00e5bb681b1664dd1ef52
SHA256b4a6a77d2e76971c6c83d7ae015c52034536a5a4ccd4cf18a01b9d9efb5ce723
SHA5126e5204f36276e1cf8097e9cb453169a7cc7179af0d72ce7a439ac0541df0e4fc778d1b9ce723b2cf72cd92eee009cafcf0c5f0d42e7d0b8d2ca596cfc15af1fd
-
Filesize
1KB
MD5f6a20169af7ac443594c6934b2980554
SHA184758c10ffbefc718ffe02d698c3329dd03100fc
SHA2564e63176bcfde53ce21da1a26d384e4a7e76dcbd7ffb76252bb751f213ba4d39e
SHA51221b3171af97161e98a2c42541c00bd83aea9bb58a7a85e4a583dbfd8a97d1cd7b96b4d7a387673a1762192a17d88e6ba5a9ec7645b13b56a64c009b199d556b2
-
Filesize
538B
MD5112df56c2dff7463fea690ef5b8d5e5e
SHA19973126180c654ec19ccbe9b67e4fccf15961af0
SHA2560634713a300f5f123c0278d18f4e727f94c1d7b261e75b1e87e1d89cfa38c1e6
SHA51266c237636938aaaca6c6412d239f515b8cafb4c3af9556247a308d437b7bc6d9ad6dc38024677cd1bf5365d6347b10e0e26b4f97061b67bf97999b0f6220a530
-
Filesize
6KB
MD5746acf5bf00ac0cb70b0b11eef1eed21
SHA12ad55ed1e98902791c4d6f05ee5599d8c63426b4
SHA256ee3c329be00b53200391bafc4ee2199fc894a54326de284a4a850420a88055b3
SHA5124aac547adfcbfa8c21a2466e5fb15e9f9b11fe2f3bdf42fcad8ba5682f090afb9b93a840ddd37b47c9ee6dd01ecf7acf05f991a926010e4b1f7c19f9a856c582
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd