Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2023, 12:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://pbmsasoluttionfactmontarfesrl.eastus2.cloudapp.azure.com?OTROS/ConfirmacionAccesoServicios/DescargaFacturas.aspx?rpu=980150701044&serie=MA&folio=000199558413&hash=138a9cad0b84301cf4d7d8b5dff88ce7&ta=1&idC=1021508932&idA=89439562
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://pbmsasoluttionfactmontarfesrl.eastus2.cloudapp.azure.com?OTROS/ConfirmacionAccesoServicios/DescargaFacturas.aspx?rpu=980150701044&serie=MA&folio=000199558413&hash=138a9cad0b84301cf4d7d8b5dff88ce7&ta=1&idC=1021508932&idA=89439562
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133408969125440189" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1580 chrome.exe 1580 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe Token: SeShutdownPrivilege 1580 chrome.exe Token: SeCreatePagefilePrivilege 1580 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe 1580 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2348 1580 chrome.exe 39 PID 1580 wrote to memory of 2348 1580 chrome.exe 39 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4424 1580 chrome.exe 87 PID 1580 wrote to memory of 4592 1580 chrome.exe 88 PID 1580 wrote to memory of 4592 1580 chrome.exe 88 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89 PID 1580 wrote to memory of 4132 1580 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pbmsasoluttionfactmontarfesrl.eastus2.cloudapp.azure.com?OTROS/ConfirmacionAccesoServicios/DescargaFacturas.aspx?rpu=980150701044&serie=MA&folio=000199558413&hash=138a9cad0b84301cf4d7d8b5dff88ce7&ta=1&idC=1021508932&idA=894395621⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe246e9758,0x7ffe246e9768,0x7ffe246e97782⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:22⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:82⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:82⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:12⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:12⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3892 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1896,i,10542909661868731229,11069757315125279342,131072 /prefetch:82⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54cae11e3f7c4d85579ec9e9a2ca3d28c
SHA1769e58833d804485afa24c0bf198c281223964e3
SHA256b94b325327c01c3acad610817b53634675406a730a489b9c6abdfbdc8ed82dfa
SHA5127d5e4974ee662a5c26924b3659047f20ecf886680bafebf9439bd9bb8efb921068bbb9dd9b676f0a063e854a93556907c2712e170a09abfbc40081804b1762a4
-
Filesize
101KB
MD5e104a3e48fdc7c145ece9cfb9e282994
SHA187604b19194340333688f571a126148df125cb07
SHA256416ba48b11318957371098178c47d26fd9db3eb46edf43a95f945fb53ca7645e
SHA512748b078b70cbc7b6eb355b9b7eba56efe8ad1fc4c27405b526d04514d97d1d35ceb4c027ef7d225c16f1a600d8c9a2acaf79d7548446bde8f62f7df36797ce8f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd