Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
256s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
10/10/2023, 11:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://synergyproz.com/local/PT
Resource
win10v2004-20230915-es
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://synergyproz.com/local/PT
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133414101552661178" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 2164 3216 chrome.exe 75 PID 3216 wrote to memory of 2164 3216 chrome.exe 75 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 2508 3216 chrome.exe 86 PID 3216 wrote to memory of 3612 3216 chrome.exe 87 PID 3216 wrote to memory of 3612 3216 chrome.exe 87 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88 PID 3216 wrote to memory of 684 3216 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://synergyproz.com/local/PT1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec24c9758,0x7ffec24c9768,0x7ffec24c97782⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:22⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:82⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:82⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3872 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:82⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5480 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3724 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4880 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4732 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:12⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 --field-trial-handle=1884,i,10614552178438723846,14282989575138309363,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1956
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv kBBmojIwn06fsFSCQpmVKg.01⤵PID:4232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cfc18634f608a88d57f10b1f23f66489
SHA19c168ec2f8015c122652aff252f5b44b8e706cfd
SHA256b5aea450b65abe4c139871b20ed0345065a79fd462ded094637e1a04ff4c5369
SHA512cf05489a80f3f6c38102e059aa22ddc73d8c9ee5965e710c24cc10515890f945f0702b1645a8abf5b4fdf23d95c23ccda8009c6a14085a1e524916013fd40f50
-
Filesize
6KB
MD59534e03c167390518d3b5a2c85188169
SHA11a6fad473e032d825d2b004d683ac83d6c20208d
SHA256f296b80b9818348755918617493b26fc5e6186f88fc4427b451ca963d49b4707
SHA5121dfc293805b2d3ccfcca42cdbe248b3d6a29448825110e7cc20509cf4e1d0c5a99d3755c4d9e24b7e3f26ef8c4bf232174e0c0fec0589ccaa8d856ccc920a191
-
Filesize
6KB
MD58b29292d4ecb71b2e7b2db6f1d98b639
SHA1d27a2bf2e73abc4ee7412d0661c1cff919d1a29f
SHA256292cb393708c75349653e375cde336fc489f1c91f1a0cb7dac065151be703f6a
SHA51252e47d1da7b312fbd69f0b75379b12eac003859e60721d08a4ca3eb95f5322d4f93caa2907e82a69c581809f662518944b3e3445e533e688fe1150fa88efa67b
-
Filesize
101KB
MD511011a1c62f0fc996673401cc8404b90
SHA1104b4cd7067ed45b87f54b7fd5c035bda2b13abe
SHA256178ca8a397a0fd84ac54ab87e8e3e69f58593554adb06ae3159fbb5c5444977d
SHA5122ae5dac21671e7c66ee8f0965077815a0fa30e217ba0c8b4ae92d927af19d753dfe89d9976c652d5bc89ecd881f397c7f9c24d75e67ddc7c96ca800c90e0bdcc
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd