Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
66s -
platform
windows10-1703_x64 -
resource
win10-20240221-es -
resource tags
arch:x64arch:x86image:win10-20240221-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
21/02/2024, 17:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://eventos.americaempresarial.com/events
Resource
win10-20240221-es
General
-
Target
http://eventos.americaempresarial.com/events
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2024 chrome.exe 2024 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe Token: SeShutdownPrivilege 2024 chrome.exe Token: SeCreatePagefilePrivilege 2024 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe 2024 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1412 2024 chrome.exe 72 PID 2024 wrote to memory of 1412 2024 chrome.exe 72 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 4788 2024 chrome.exe 74 PID 2024 wrote to memory of 3312 2024 chrome.exe 75 PID 2024 wrote to memory of 3312 2024 chrome.exe 75 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76 PID 2024 wrote to memory of 4768 2024 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://eventos.americaempresarial.com/events1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8654d9758,0x7ff8654d9768,0x7ff8654d97782⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=228 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:22⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1608 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:82⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2640 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:12⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2620 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4700 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1844,i,12003120990839642490,6795681416174821450,131072 /prefetch:82⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD57e70053692b2370c9b2aa6e4aa89755d
SHA1aaba688879dd0e07c6081510093d84468608d039
SHA2561a626d0201db540385426e0d2ace1b2a8bc6e4b9fe04ee0a3574e3e2b3a5b4b2
SHA512679874c734841b776fd9ba34ce3be6e7e97bfe5b25a1da07be0f3439906966bd768e673a93266108c8f5d03bf7685da87141695c410dda787c9ff1b6898f00d3
-
Filesize
707B
MD53faeb805243127ac9db33735294b8826
SHA11f7856ecd0c6524bd9360eb1f3f8ed62e2dee269
SHA256e5203f77cae9141d5efba0dbf7c8afa9fe405bc6d56c978488dda86f7990c7b5
SHA51277d98b95d63632b7e8fb7ef95403c1c51f2f379b34d76447dbbccce5b26ccb3dc94db4c83ef7d872ea1377e6ce3abaebb532db38a000d5ac95566292c053cc91
-
Filesize
5KB
MD57010c18c4562bec5d46b240f7a53dffd
SHA16ff91012951ad3b3491dba0959754b505e1218a3
SHA256131eed63dfdafdbd1b88f4574146cd0e231a0b61301a761df58e929dfd033804
SHA512b7b226f7f427f7658be3d14ca175aca4c48ab150cbecb40eb582ea7ac6c3c9611dd99aab6975a5153122c42aed4dfcc13ac2931c0d812590ac32b7c83b8cd46e
-
Filesize
5KB
MD596f053ceae1d8210712f831caef87c4a
SHA1d06288eaf0bbe3b7a2aaa57b83b2ca0533a0b2bd
SHA256329fa94645b8286726349018829678309f28a63d9ecf97128660797f880962ac
SHA512dea72c05b5f9a78f189f3803e97b68234d4b2903691fdd387c54a568610834f07579d88f289f6849133c962c35faa646f103345da764efd7aa44142eec91d3ca
-
Filesize
130KB
MD54ec1358c621da4e9df25f770f8fcd9c9
SHA1c11b73eb3d738edd56ae0c0e1a829535260fd5dd
SHA25644d15903d8c8ca2745f3a41d8334805d30f70fd02364f5a640454df1e0eed1ab
SHA512cb74b7767ee23e1c9291a623120e725aa3612006c7e00cc3bdb589df07fbcc32d678ecf1f85441f627aafd9c8dee09dd9118eff1133962c734e5b18396d1b154
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd