Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 18:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://url5785.placcar.com.br/wf/open?upn=annEFs5MER3ihLBK9cxO-2BcD-2F2hsAsnUDWK8oQcbYVvn8jbCJwimT0wADprkPjlMs5om3xHgZZaoe8A8Ski0YHjf32nm6tItD5KIqobMlZa60zdKPTc25fGCGV8I1eNKgHiF0trWMY0SMFOx6yU2a-2FVo2dd4e3njXWE-2F2mTmLqeApmefswmMCmxXj1RgBu7P1fPmn9zIR6VHw1tPakbNQROATKGvInBFMnR2B8-2Blml-2BZXtzx9QrkFwlm49cogrLBVaNLuc0oNetba-2BZSIX-2FY4DFslloI-2BU2SZKZfuiIxSutQUpOzRtO-2FJEtkRhwBLKxIeDGscGwHyq-2FVTikrCJvQpnOB0-2Fw0OIlitwSwG8YW0GpRSeZvFlm0zyQ52ySejJt73VYJ8sPT7nEOYpdcJeCqOcJwjTURh81sYc3D-2FteHLlec4bdeNCUcs-2Bp1x4UwJMFNj
Resource
win10v2004-20230915-en
General
-
Target
http://url5785.placcar.com.br/wf/open?upn=annEFs5MER3ihLBK9cxO-2BcD-2F2hsAsnUDWK8oQcbYVvn8jbCJwimT0wADprkPjlMs5om3xHgZZaoe8A8Ski0YHjf32nm6tItD5KIqobMlZa60zdKPTc25fGCGV8I1eNKgHiF0trWMY0SMFOx6yU2a-2FVo2dd4e3njXWE-2F2mTmLqeApmefswmMCmxXj1RgBu7P1fPmn9zIR6VHw1tPakbNQROATKGvInBFMnR2B8-2Blml-2BZXtzx9QrkFwlm49cogrLBVaNLuc0oNetba-2BZSIX-2FY4DFslloI-2BU2SZKZfuiIxSutQUpOzRtO-2FJEtkRhwBLKxIeDGscGwHyq-2FVTikrCJvQpnOB0-2Fw0OIlitwSwG8YW0GpRSeZvFlm0zyQ52ySejJt73VYJ8sPT7nEOYpdcJeCqOcJwjTURh81sYc3D-2FteHLlec4bdeNCUcs-2Bp1x4UwJMFNj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133408306278577356" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4208 chrome.exe 4208 chrome.exe 4204 chrome.exe 4204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4208 chrome.exe 4208 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe Token: SeShutdownPrivilege 4208 chrome.exe Token: SeCreatePagefilePrivilege 4208 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe 4208 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4208 wrote to memory of 2100 4208 chrome.exe 86 PID 4208 wrote to memory of 2100 4208 chrome.exe 86 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 4968 4208 chrome.exe 88 PID 4208 wrote to memory of 452 4208 chrome.exe 89 PID 4208 wrote to memory of 452 4208 chrome.exe 89 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90 PID 4208 wrote to memory of 3164 4208 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url5785.placcar.com.br/wf/open?upn=annEFs5MER3ihLBK9cxO-2BcD-2F2hsAsnUDWK8oQcbYVvn8jbCJwimT0wADprkPjlMs5om3xHgZZaoe8A8Ski0YHjf32nm6tItD5KIqobMlZa60zdKPTc25fGCGV8I1eNKgHiF0trWMY0SMFOx6yU2a-2FVo2dd4e3njXWE-2F2mTmLqeApmefswmMCmxXj1RgBu7P1fPmn9zIR6VHw1tPakbNQROATKGvInBFMnR2B8-2Blml-2BZXtzx9QrkFwlm49cogrLBVaNLuc0oNetba-2BZSIX-2FY4DFslloI-2BU2SZKZfuiIxSutQUpOzRtO-2FJEtkRhwBLKxIeDGscGwHyq-2FVTikrCJvQpnOB0-2Fw0OIlitwSwG8YW0GpRSeZvFlm0zyQ52ySejJt73VYJ8sPT7nEOYpdcJeCqOcJwjTURh81sYc3D-2FteHLlec4bdeNCUcs-2Bp1x4UwJMFNj1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe3bc49758,0x7ffe3bc49768,0x7ffe3bc497782⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:22⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:82⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:12⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:12⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:82⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:82⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=892 --field-trial-handle=1888,i,9979598827332542916,14548519867582197023,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f4d0e6dab47b95b7bf6bccea6156b20f
SHA1587deb65364095a92f2013a8d4383ed2092edd1d
SHA256fcbf2cc81a703282ffa4bc8af6d7fcca7952dabedac00e98907b7bd729395d34
SHA512588d314f36a5564c846b9bcab9f76ff1ee90e0bfa0cc0decf0dfee75e4c75fd3e84b427d846cf7fc59ca81c5abd3c28bc6593b17d76fd23ed343a581e45deeb4
-
Filesize
5KB
MD5391b6d339581f79d8f415d3aa9aead39
SHA1791ed731e713b162a860dd8685df2741cdffd63a
SHA25690139506ef7a9336512e86807a7980cbcac8b4427f66904f27296210e5749da2
SHA512858aea2de2f7e69ae4cb65de03e90ea6cf2ef775fb51ae81c68050967bf4d26fb6f749804031abc352b2467bf3c45d66254b4178d336e30b93ae75592488467e
-
Filesize
6KB
MD581cd845dcb4db9b23922255055e809e8
SHA1e786101ae613371f7968185ad7b36742449cecae
SHA256056ccc8efe6bf9410df4de0d28b01b73cb0f9adac066ab565059d65b5370c108
SHA5120b4c62e6885a53427c192ffe3ef21d7d141fe36fef27465a494471043c99ec52454b26182cc6fc5f8f801baf0fda2e5e4a5946b17acca62d2315ab42e6b8810a
-
Filesize
101KB
MD5e245fc6bb6eb6bae6c4d6897f90f906a
SHA144a66d5cc6a13d3d7e2d316d372832cb164ea598
SHA256de13db480d64183f333a24e82764818981e6b2a740df22d40c1ed3859a7a7f8f
SHA5120d88dafc89ab1e082eea8dad5dc4c36d0a65ea1b86fb9532be2bab135f5d8dd502325ede40a66a37919e429771530704617f32fb7fdf0deadf12ddf1a032b68c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd