Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 10:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://inloggenklant-internationacardservices-apparaatbeheer.codeanyapp.com/PT/
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://inloggenklant-internationacardservices-apparaatbeheer.codeanyapp.com/PT/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413194746989984" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1844 chrome.exe 1844 chrome.exe 3860 chrome.exe 3860 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe Token: SeShutdownPrivilege 1844 chrome.exe Token: SeCreatePagefilePrivilege 1844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe 1844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 1860 1844 chrome.exe 44 PID 1844 wrote to memory of 1860 1844 chrome.exe 44 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 4488 1844 chrome.exe 88 PID 1844 wrote to memory of 2036 1844 chrome.exe 89 PID 1844 wrote to memory of 2036 1844 chrome.exe 89 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90 PID 1844 wrote to memory of 4636 1844 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://inloggenklant-internationacardservices-apparaatbeheer.codeanyapp.com/PT/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff066e9758,0x7fff066e9768,0x7fff066e97782⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:22⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:82⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3368 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4948 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2740 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3464 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1888,i,4220839710637973664,15766150803489175797,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b7585742ab9e41ab21e0c70596215e67
SHA14c6e5eda009d3aecb1b54da60bf29a9513e7c6e3
SHA256630406d2d39d021cda671bc5efc286d09cef48178180fc679e711561e85da979
SHA51262052eeeae49b1758cbdf3e8eef096593574ed1c5b3ffb5ddee5472e36fedf817aa0f6ba256375b11379e1f6dbbaec1ee3c50904a6c60e2d6c2c7687e9f6ec8a
-
Filesize
6KB
MD50526bb734538f47323aa5bab42b4f3b8
SHA1793184791c30ed112aa6ca47535154388850218b
SHA2560bd8f19f8e30cd34b27981610829abfd6d6bcee837088b880f3a23986c0ee096
SHA512722d360aa8fc0ce859585293510cbe7673b7316e2ee60fd58c980c7f5c41d685ea485a84e437a221ee4d1ab256c2693c3206e280538f0cd690c1bc80e02fa4cd
-
Filesize
6KB
MD538ed8d638290f454186231a9b7ab068d
SHA146b0472bbb546f127a582ba9e0e90782f76f2005
SHA25643d103673ea4b9938f371905810871f193d4bd9620fc89c76e3f212f278e9921
SHA512d1404fe52625b7df44e9cfd87a194a086a1aee5da63208c7e154d3ee1d44a6d90fd93f176b0e79e7d09322f4dae1a6a0306b400fcf17e1b1ae14c2abf23e618a
-
Filesize
101KB
MD5dbdfe41ad4d36e0ac3846998fd4b2979
SHA1bf01c8572fcb1c339df9bae84cd4ac645f4559e5
SHA256b8d34ae7c43578388adf32d7357af1f79722e94662450a5242ae62d2cb9388f7
SHA512889db136dc676f63e60cc7a1882da58b2d77655f4aeffe0534d1b73a422d7ae9e6b955758ab87af2325946532cc72db78da93183db38b8054bbefe04918a657f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd