Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
610s -
max time network
498s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2023, 06:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://adjuntodocument.from-in.com:3000/
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://adjuntodocument.from-in.com:3000/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133451945919346156" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 1788 chrome.exe 1788 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 888 4340 chrome.exe 77 PID 4340 wrote to memory of 888 4340 chrome.exe 77 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 928 4340 chrome.exe 86 PID 4340 wrote to memory of 1812 4340 chrome.exe 85 PID 4340 wrote to memory of 1812 4340 chrome.exe 85 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87 PID 4340 wrote to memory of 744 4340 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://adjuntodocument.from-in.com:3000/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba8639758,0x7ffba8639768,0x7ffba86397782⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:22⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:82⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:12⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:12⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:82⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 --field-trial-handle=1848,i,12869545925690614799,2871877315926426731,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD576235adf237ad3d73a491a3be8ac307b
SHA1bfc0fee8ab19945f83516fd5034d5f768df54d70
SHA25610103675949dd1029b4f0dace4d0a7f0a8c55803b14819619cc2a67883b0c7d6
SHA5122f2060c225b8f11df3ec64089f6255e033efc51e634a03d95b84a0d20c45396f475aea6a2a33dfd0fb99dfb39ca0337df8bccaee6d713a4012b3dcc6949faafa
-
Filesize
6KB
MD50e4831bd2f8b91fc175dfd80245812e8
SHA1863b68e5a1aff8732b27be44513002aea4823ecb
SHA2561c8b4ac1a9d7ca9013795c031f69b65edf3cdbe967a857bc1e45b077d4df1828
SHA512b60e333a4470755fa18f17763b848bf2b5982ac61312ec585433f3722b912eeee24f8446dc831b62c730cbff107d7e3c0ce12dca5442514e3b4ac2b3fca87cc4
-
Filesize
109KB
MD55908ae3795f8805a574a9c3a097b2556
SHA111325202e69cfc78e0ab2bef3e4e7b0f26e88510
SHA2567a41d45d10f624f89f5885959b0894fe4cd1c8c95f2f06e1dc420557719094e8
SHA5126cf9e54da1142ec8fb77227a7bb22e35971bdd26a5ac9820592fbb6ccd39fca49675c6388e97758e15e7305f2b031130a8742d987eff775bee9313872b90fec1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd