Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
10s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 04:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://scacorp.file.force.com/file-asset-public/SegurCaixaAdeslas?oid=00D2p000000QWx0
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://scacorp.file.force.com/file-asset-public/SegurCaixaAdeslas?oid=00D2p000000QWx0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133535693063339282" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1036 chrome.exe 1036 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1036 chrome.exe 1036 chrome.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe Token: SeShutdownPrivilege 1036 chrome.exe Token: SeCreatePagefilePrivilege 1036 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe 1036 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1036 wrote to memory of 5064 1036 chrome.exe 47 PID 1036 wrote to memory of 5064 1036 chrome.exe 47 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 2992 1036 chrome.exe 88 PID 1036 wrote to memory of 1488 1036 chrome.exe 89 PID 1036 wrote to memory of 1488 1036 chrome.exe 89 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90 PID 1036 wrote to memory of 3352 1036 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://scacorp.file.force.com/file-asset-public/SegurCaixaAdeslas?oid=00D2p000000QWx01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb88f9758,0x7ffdb88f9768,0x7ffdb88f97782⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:22⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:12⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:12⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1068,i,8417600472113261455,11816451811088221988,131072 /prefetch:82⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD5eb9dbcf4baab8b608818cbf424f6c1f9
SHA1292629fbccd5aae5d2d967a23ab5dd4c2f286857
SHA256df834d826eb8596370d29a6aaf4bf306528fa0cce2ab7445794332cd7ccac977
SHA512393eda5cc9b7daed221cfe9ef378d83111680eb3d703fee7803a1ea9d5d2318f4aecb1ed297bc60057371d033cc8b39fb9cf59ffb08af9003babee4d820b0c2d
-
Filesize
6KB
MD5d4d158d28b3b5299863faab9c8ad33c2
SHA158a7f6ebe861807a0028d4c11f2670dfc114692e
SHA256ef009c0d9a494a899f55a965dea4e5ecae15e7d9c9afb246dde19a139fa6f1ea
SHA512d7dd60dda41bbba70039b29de523d16ad4e305e3024254f0d37a8c9f87152a2eaa8b9d01feb1e6fcd0448e043dfe98d612b4185ee0e093644ec201eb8bd61fc3
-
Filesize
128KB
MD572007ebc841bc13e03571a93d3f71490
SHA102f004d61f7d1c0659ca579dd0c3845a865b0d51
SHA2566c6bbfd63a88335ab7f15139c3a9f29ee63dd337fe783431df0e4dde96170fcf
SHA512a291ad9a449a19b5293924cd612560626b1c1332bce3374e0583bcfc28592eb8458b68e3107af9fee341d6ff626fc0d0590bc9a9300a5741d2bf61b80d66dc40
-
Filesize
103KB
MD555e37a9b03dca29454717d397305df02
SHA16403cb828f5285edfaadde063c4e8e4067b73170
SHA2569e4078bab61d312ac7248881871dd2a3ed7822abd23c712adf31a95fe21e5f58
SHA5126644d5fa584ab87bee53f1276dea75a426b0330ee49b80fab686cc1c8eaf6fa293ec666665b7243c58e363fdf2bf49a2c0dcee2e5f41b8f22d38c273e876fb7b
-
Filesize
102KB
MD53fa000102ba32b7e33b4eb7b533287f8
SHA1a052a29bc5bfbb6d4faca1aee01c53b994f3f9c3
SHA25609c99c0c0041ba8cf14192e12fd7416d06f816be417d58785ab8244734965660
SHA512b93dcdaef9c64feedf610fee48c8edd7b14c0676c834829e82fceb4a572e58f0ad8c92d1303e5a32e0994160010decbed706620bc7c8de7a8f4b3ab7440467d1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd