Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
493s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-es -
resource tags
arch:x64arch:x86image:win10v2004-20231020-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
16/11/2023, 09:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wizink.ptcartao.online/login.php
Resource
win10v2004-20231020-es
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://wizink.ptcartao.online/login.php
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133445989496627449" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2176 chrome.exe 2176 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 736 2176 chrome.exe 86 PID 2176 wrote to memory of 736 2176 chrome.exe 86 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 3864 2176 chrome.exe 88 PID 2176 wrote to memory of 4668 2176 chrome.exe 89 PID 2176 wrote to memory of 4668 2176 chrome.exe 89 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90 PID 2176 wrote to memory of 380 2176 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wizink.ptcartao.online/login.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffdf4a29758,0x7ffdf4a29768,0x7ffdf4a297782⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:22⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:82⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:82⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3884 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2960 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:82⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3152 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2736 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=216 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3752 --field-trial-handle=1876,i,10282941472891475750,1909006970045730462,131072 /prefetch:12⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9722d3fd-f397-455e-8e53-0764f97abb9f.tmp
Filesize6KB
MD5b71504ba646386095fc0a9f96a966ecf
SHA1f22bfe6c77a9ded3a61ce6c5a2d9bdb1bfe8f5d3
SHA25688493d0a156b34425a4a9030223d78b7b05a9605ab9f64ef405f874187772954
SHA512716ac405c3474e974fa39affeceab2d231fe81b96d27347fd92867488ae060b1ca38b8e95fa7f77525938d4a931c5c47b4f67e7643ec82dfd770de7d549e3059
-
Filesize
1KB
MD51e8c9dc74f03e50190999df197123615
SHA1ae15b371cdcc51599dca2377693c2369bc275dd8
SHA256293acb42a67618a82ce85c0356615a04e08761ae45659b0679473bdc39b4d6d4
SHA512a6953344573fafdd1b117c3c5491ddf5ab293f6686211c1e30bbbb95e0118722ce3ab3f6d72eda6528031da4f53b04905c4a270182d26b7601e4a57d9f32b738
-
Filesize
6KB
MD58d3db96f59128289ade840f8f02732aa
SHA1b1a0960acd6430639621fcc51f58d9027b04f0af
SHA256db4ad7db772d423d21c42183f8e18a54570c911f37fec447816e9d3552a1e9e5
SHA512b4a04096109e45c4e76645aa1cb320f26aac99e624e58f3460d50f95ef67b42d31d6165491c1e913eaa3630d9d03a497ea1dbef7d8989a2f9819dd22200b6551
-
Filesize
109KB
MD5097b3a1f03a14d52d62fc62bd4afeaaa
SHA1086b6ffc11ad69c4364493d5861e6c0e5a03c157
SHA256525b7ca4e46fceb998b6788604bb7f037c24385f75a162e2e14ac007f1590691
SHA512c6c98a776eab4b27840191017c49263ba72fed106681fc98f4a4406434d7d59e9fec932dfbc94fdb8cf7be12b4947eb7d6070f00dd98d8d0c2a0efb61d48bfa2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd