Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 16:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://c5mo0i.clinicabrunovargas.com.br/ArdeQP/EfuKP2EfuKP2hnz1S4nz1rBAH2eCHn2q033K20QaOCdnn3wcbROr4yX7mYzrLLqvdeZyg749QWiTQIt7Brg8oBq1X05Wt9T1Em74LPGPVpwPuImbMe3HjLA35aTYcahUT0dCPLXB4ictRuBmtS9V8oE0LZMgtqeU4XAYxExMhLbngmCpbH0MpR51WiaR7fsUjiZNKRExFeeOW7bFyMoEdbno1sfIztGNgQ1icUXqH4TvtuY3AMBLh8Poq1VItzA1wZR1GwJjdN29ges94m1ui00Chb444yI1C20xpvc0IBLfFURPMAniYguM-bW1hbmlzQGxvY2t0b24uY29t
Resource
win10v2004-20240508-en
General
-
Target
https://c5mo0i.clinicabrunovargas.com.br/ArdeQP/EfuKP2EfuKP2hnz1S4nz1rBAH2eCHn2q033K20QaOCdnn3wcbROr4yX7mYzrLLqvdeZyg749QWiTQIt7Brg8oBq1X05Wt9T1Em74LPGPVpwPuImbMe3HjLA35aTYcahUT0dCPLXB4ictRuBmtS9V8oE0LZMgtqeU4XAYxExMhLbngmCpbH0MpR51WiaR7fsUjiZNKRExFeeOW7bFyMoEdbno1sfIztGNgQ1icUXqH4TvtuY3AMBLh8Poq1VItzA1wZR1GwJjdN29ges94m1ui00Chb444yI1C20xpvc0IBLfFURPMAniYguM-bW1hbmlzQGxvY2t0b24uY29t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608698853152087" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4332 chrome.exe 4332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 1332 4116 chrome.exe 82 PID 4116 wrote to memory of 1332 4116 chrome.exe 82 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4232 4116 chrome.exe 83 PID 4116 wrote to memory of 4872 4116 chrome.exe 84 PID 4116 wrote to memory of 4872 4116 chrome.exe 84 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85 PID 4116 wrote to memory of 3160 4116 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://c5mo0i.clinicabrunovargas.com.br/ArdeQP/EfuKP2EfuKP2hnz1S4nz1rBAH2eCHn2q033K20QaOCdnn3wcbROr4yX7mYzrLLqvdeZyg749QWiTQIt7Brg8oBq1X05Wt9T1Em74LPGPVpwPuImbMe3HjLA35aTYcahUT0dCPLXB4ictRuBmtS9V8oE0LZMgtqeU4XAYxExMhLbngmCpbH0MpR51WiaR7fsUjiZNKRExFeeOW7bFyMoEdbno1sfIztGNgQ1icUXqH4TvtuY3AMBLh8Poq1VItzA1wZR1GwJjdN29ges94m1ui00Chb444yI1C20xpvc0IBLfFURPMAniYguM-bW1hbmlzQGxvY2t0b24uY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0ab9ab58,0x7fff0ab9ab68,0x7fff0ab9ab782⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:22⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:82⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:12⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:82⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4484 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:12⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4472 --field-trial-handle=1864,i,13408828050303012911,5325562108633231339,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4332
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD59857b3bafe0fda0e35c2784a0be4b837
SHA14c9a10acbcbadc2b40d9502a08ee591652c4c93f
SHA256a9c72f7ad151dbd67fea9e597f3287fee7fb0bd03b7b96e0166dbf009a76a463
SHA512ade34a40c36cf6c57f9081fd0d2d3083ea41c8524846e9605c27edbe150b46fd15e8465f37f06dbc5db065b97f14816bc16f6e3795a2010762d50763bd850315
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5ecef266f8f149a980ad4d43894cf62ca
SHA19cf0042c8c933006f3ef82793e366b9b7500832d
SHA25682e042e9edee0ac205d301e8267080c2fcc25b6b8dd269638160f459504f451c
SHA512a0cc79b1f9d487647d02101e944650496773a7bdba05fec714580ed013d3ba8558045522444560e1b3ff83388fdcc095ceb5c70f2c93cafa201708af76772e9f
-
Filesize
7KB
MD58faecd7c234cc21fda8269aa18516c41
SHA1c91a286c9c7a940aef2a8dd4010271d82e5160f9
SHA2568fcb2d05f31cefe3d55723cc047f12b8816eeeb42ad1d0101dd86ed3343e2629
SHA51265181b5be9f907e45ca645715ef98891b67d826fab1691a3821e7a34c3c1a2ca22998e5b7508dbed257858ca8524e1a1215df57a039209700f33671b822e70ae
-
Filesize
255KB
MD5e07ffbb167e21e4f50fa10d2c25278ba
SHA118d318b7387c6e73d269b4efaba7f597ae9837de
SHA256707cf05ca8520ba736824f04077bb2c46df1ecde4931315138d084c205d5408d
SHA512133145010dd7684e45edfc3c227a953099a5beb0a6bbbb0f3da0dc34edcf281d93de9dca76b88e530dedca150dae1b65c6414a22320a09b02059594691a67d5d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84