Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 19:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://midasmap.uaslp.mx/midasmap/vendor/league/flysystem/src/acces/payxm/logmx/mxcor/portal/
Resource
win10v2004-20231023-en
General
-
Target
http://midasmap.uaslp.mx/midasmap/vendor/league/flysystem/src/acces/payxm/logmx/mxcor/portal/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133438600662264066" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2840 chrome.exe 2840 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2840 chrome.exe 2840 chrome.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeCreatePagefilePrivilege 2840 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 1776 2840 chrome.exe 64 PID 2840 wrote to memory of 1776 2840 chrome.exe 64 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 4072 2840 chrome.exe 87 PID 2840 wrote to memory of 2932 2840 chrome.exe 88 PID 2840 wrote to memory of 2932 2840 chrome.exe 88 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89 PID 2840 wrote to memory of 4452 2840 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://midasmap.uaslp.mx/midasmap/vendor/league/flysystem/src/acces/payxm/logmx/mxcor/portal/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8f929758,0x7ffb8f929768,0x7ffb8f9297782⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:22⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:82⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:12⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:12⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:82⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1892,i,14406215999624327020,5676632193052655765,131072 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5ccc3831dd8a6a4748e822470b57bf550
SHA141581e68a50f469f62c84dac5dd834c182d289f5
SHA2564529992943fe7d0200eb719dce9fd435ea8d0b3c021d4fe19c8f9899d1debe78
SHA512ce4ed8727fa5d24ac1e39fdd5b737c149165ab147b397f828d89ebbcadfaaee1f5f3d94343a10335ec79411dd835b3f296ebf03dcb6fa77710515e8dfae088d4
-
Filesize
1KB
MD59d1c32f5c8bc9c74116eb3c51a3ae1ae
SHA1c02856e7d75867ea28145dd210f0c90dae9836ba
SHA256dccf18df6a2a9d95908a9204f34898adb54bfa3a3d683b043b8d9c2c636ad73e
SHA5121cee2914581203ba7141febdd0faee4021a7aa1db7b9331058ec1fc958cbdf368b71d1ea67bfc28aa1da31ddd4af603303b8acffaa89886ca9d997701d71e68e
-
Filesize
537B
MD5465766ae37af782029932108df738f7c
SHA14b9bf780a198f9649bd6b8f28f6b002e4e729086
SHA25658ae7b4cd3a09dc9125190850e325319d0c769d41088a5ed5f2769516b6a4344
SHA512707ef7c595164f7ff09ffaa8bec15145a618784ccdb3e42b20faa60756866b33b3959a88f016efadfbb8360644f2a86da2586f31cddc80e6e56804a246752285
-
Filesize
6KB
MD53153506553cc947a599215573f394cc9
SHA1907687ac424c8d33d078bdf7a0a5fb3365aae2bb
SHA256bd4960955d408edd2ecc51c0defa76a69d8253e48c1750ae6ec04d2ec1633e7a
SHA512e9d95f2f418bbe41fb70804508eff8c02a6669565fee9c2abe4c18bd7358daf6871ad01fda76a8b40152ce77b9cd54a782ad4630fcbaad1f5a46f2fc3854c449
-
Filesize
109KB
MD5107e89e1fd908ed9d10947f94da02d4a
SHA171068171e25f8c75e6bc9bf8a9442ecf5257cc99
SHA256b5333666c38ac752db9454885d302f2ea990bf7fd39b2fe7e6879fb12b8bd3a5
SHA51289edb5fbffff00e6150559b1fbd16faa19b352531073fdf16619182bdebc5c256c5f3f452bed3da5a69e2766738564dd0087a81bcfebe686d3acb63f95303c8b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd