Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
270s -
max time network
248s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2023, 14:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://eventos.bna.com.ar/eventos/email/desuscripcion/523A3D3B150BD81A?category=ISdFOkfNG6k=&eventType=Desuscripción&wc=PU&etc=/KHgFcgEBa+HtpCDG44FPSl3BhXQxHqEFKr9fCqvxlSYr/+KLBAAbvKVfy+fewnevjacAbi0M3o9gkl49Ct5lg==
Resource
win10v2004-20231023-en
General
-
Target
https://eventos.bna.com.ar/eventos/email/desuscripcion/523A3D3B150BD81A?category=ISdFOkfNG6k=&eventType=Desuscripción&wc=PU&etc=/KHgFcgEBa+HtpCDG44FPSl3BhXQxHqEFKr9fCqvxlSYr/+KLBAAbvKVfy+fewnevjacAbi0M3o9gkl49Ct5lg==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133448787242769988" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4988 chrome.exe 4988 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4316 4692 chrome.exe 24 PID 4692 wrote to memory of 4316 4692 chrome.exe 24 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4172 4692 chrome.exe 88 PID 4692 wrote to memory of 4232 4692 chrome.exe 89 PID 4692 wrote to memory of 4232 4692 chrome.exe 89 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90 PID 4692 wrote to memory of 3176 4692 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eventos.bna.com.ar/eventos/email/desuscripcion/523A3D3B150BD81A?category=ISdFOkfNG6k=&eventType=Desuscripción&wc=PU&etc=/KHgFcgEBa+HtpCDG44FPSl3BhXQxHqEFKr9fCqvxlSYr/+KLBAAbvKVfy+fewnevjacAbi0M3o9gkl49Ct5lg==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd5709758,0x7ffcd5709768,0x7ffcd57097782⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:22⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:82⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:12⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3860 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:82⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 --field-trial-handle=1860,i,435087433807285940,28593526083914533,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD59f61d7b1098e9a21920cf7abd68ca471
SHA1c2a75ba9d5e426f34290ebda3e7b3874a4c26a50
SHA2562c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71
SHA5123d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029
-
Filesize
168B
MD5218726bf672ddb34d860a7d7bffd61e5
SHA1573a97006e7c55efc8c40caaa2a4e2f8c44d212b
SHA256ed82dd7f01c8f3fb543673f0198eaf44e36ce203f4a046549836cfbffa6bd5c6
SHA51262ba8136cefdb20ecb535aeb9931fb9eceb1b7b5319be3c02be73adc342af92ecaab7c9836dcf02e18799b3b3f1823ca1475997e8fbd84a9fa31fc18a6018617
-
Filesize
216B
MD5026125848e1af1cc3bfa7ad255be5c96
SHA10a1c08fb9202b66ae1cbf4adbb3e8d8f36ba3972
SHA2569b01557001bf27324a7fbc35c819c9288160ce114be69bbc362e0c50b4ab5f62
SHA512b3064c7b34810dc70d8d8f537b91d5228a6f2fed48638714531cd9c35abebb306fab8e42d12b3ca355363c093e075524c48fed37cde6f572e6656e4ac6c0785a
-
Filesize
2KB
MD57c06590d92655d410321bb4470989b8e
SHA12128bec7dd59ac043762efbeaa8f9a0fea531af4
SHA25692df3d59fac98f2c94c1b83ebcc99b06987af93bbe2ef11e9a8e2424ada0b28a
SHA5122c794cb65d01adb10b1c15d68cfc96d429be0cd94b6401dac809ba7027d57763d2f253eda6387bc05c227140b033ffcd35f7dac4061bed682a7508915a7639ad
-
Filesize
2KB
MD519a01580c1a6535adaa85fc574c5e850
SHA1faa95d1c8142ca4525dc4b4f72c82cf63b4d9715
SHA256328cabd7edc2a6ddf74ab52877d694f63600554cb73c09710173081a544e817e
SHA512837f2aaf53a8df25ea8dd9586093a786d4f07d2c567f08e9032767c10014b311af66212058f2608f3beee6a85c9cef8b783868fd80ee8f2e8d61af2f0a882782
-
Filesize
6KB
MD502a81149903472fccc56e4fa53d9a4d6
SHA1c03776defbe8c4733343e7c28d88b0668192443f
SHA256c51dbe9817f53598dc3140ff3eec16bb807e3dcbe0d2e8cdbbf5998ca757bc75
SHA512323d8389053977252e062cc491fbd7756b69d3d84872ece1498c5b31b2eb3d9fc13ca83421b0c0d75d581d3428894174ea2acc757e139d8b7d818a77d656328c
-
Filesize
6KB
MD58345bbb0dbae3a4bcc633e45f635fdcb
SHA1bffafe4aec23f5d383d8c275b0ab1e3f7460dc8d
SHA256cf68a6cb90756d7dbb0f99859737314f86f1e4f32df0abff619360383ec39a3e
SHA5124eded382f0723af166b801689dde54c07f6b144b6b3b6b563f4f6df58a55643fcbfe79e002ee413e9d3dbc9ac7345493f9b817826afe903d5be9f595b8fb67a5
-
Filesize
214KB
MD5f8fa09b6a35253abf42b949b8a7a96c5
SHA10cb4027aef00dbdae51953e556846026efe4ddd4
SHA256ccf09ca8739fc0ddaa71a0d68367636da4658efc032bef6369444a25b1d0305e
SHA51202ac9ca87c1d72fe30cd228cd022487157fc18a9ab77c0d8114ca18e42f5ca1f93b0f2d9b4e8dffffc5524efdad8d683adcf683571a2940631be216920b0e706
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd