Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2023, 20:06
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://brvscu.com.ar/wp-includes/new/auth/0hcpdb/[email protected]
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://brvscu.com.ar/wp-includes/new/auth/0hcpdb/[email protected]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409235930777989" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe 3416 chrome.exe 3416 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe Token: SeShutdownPrivilege 3348 chrome.exe Token: SeCreatePagefilePrivilege 3348 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe 3348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3348 wrote to memory of 1084 3348 chrome.exe 61 PID 3348 wrote to memory of 1084 3348 chrome.exe 61 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 3096 3348 chrome.exe 89 PID 3348 wrote to memory of 2164 3348 chrome.exe 88 PID 3348 wrote to memory of 2164 3348 chrome.exe 88 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90 PID 3348 wrote to memory of 1628 3348 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://brvscu.com.ar/wp-includes/new/auth/0hcpdb/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6c1c9758,0x7ffa6c1c9768,0x7ffa6c1c97782⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:82⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:22⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:82⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:12⤵PID:244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:82⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2884 --field-trial-handle=1572,i,15511002840255528455,9974742914030635787,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5252efd0fb12294f2c0fe0b8c6e96b4ea
SHA167624329bc34aa8f9ee0f580fb3737570128afff
SHA256df3efc535efe5216001a811f919381d1faa9fd2a540bbb74661a63eb057b855f
SHA512b985a1904bb2364e9bedc5de74d34ba763d23c6fe84053832fbb750548bdfaed983fc36669baea39138621f8a6ad985ad24e912a0f8e07982805457f11e92005
-
Filesize
1KB
MD500d3ff53b34f6024123edb62dd70ec9f
SHA15230ca0e2d423a482be72a2b93a2dfe752353878
SHA256004830e079f129fdba0b0908bd6f0734f2aece5285ea0f8f9f103c168d093ee7
SHA512bfd017d590ff501e784a8e761b2cdeb84ca85bfd607aef08bd50cdd5678c10a0e1db6dc5853d988affa886982e2d5b9aed840ca6ec37bb6e074d86a989b79ef8
-
Filesize
6KB
MD5bcf6341acc6e050c31f591f9b74f3970
SHA1ef865d5eb37f59102913664ba7463ffc3ed05147
SHA2561790c66bbe5e40e68746e62aeb41fca9e2500f824313c6054e07daee27d52635
SHA5125eb71d918a79b5d68b359a1931976e89c3e1ec496176cdc4e56ee79f078d618e200b818026ed221a921a794cf9ae040c73a5ca5c93c98b43ec9519c2043a255f
-
Filesize
101KB
MD5b7ca679d669c64ff4dba78c06559acb3
SHA15c87a5d017e0408e4b4aadb78e78b58132caba51
SHA25683feaa2b264b2e35b3dd7ebc919c5e9fe5c7ec47cd2a41e52f0a109c0695f695
SHA5125c64da748ba7e9b89684bf60da7c7ed91a792526c71b279381e73ef015c7716d25ae47592db873b2a2eee04717cc5e3e9c74352ab158d9ee2592528dd6591103
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd