Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 16:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://leorganicafrica.noclick_com/new/itauabril/index.html
Resource
win10v2004-20240508-en
General
-
Target
https://leorganicafrica.noclick_com/new/itauabril/index.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625987618673981" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 3724 chrome.exe 3724 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe Token: SeShutdownPrivilege 5000 chrome.exe Token: SeCreatePagefilePrivilege 5000 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 1976 5000 chrome.exe 82 PID 5000 wrote to memory of 1976 5000 chrome.exe 82 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 3404 5000 chrome.exe 84 PID 5000 wrote to memory of 1276 5000 chrome.exe 85 PID 5000 wrote to memory of 1276 5000 chrome.exe 85 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86 PID 5000 wrote to memory of 5016 5000 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://leorganicafrica.noclick_com/new/itauabril/index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9021ab58,0x7ffe9021ab68,0x7ffe9021ab782⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:22⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5112 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3404 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5068 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1560 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2408 --field-trial-handle=1924,i,5043384630814472094,11564556058413139281,131072 /prefetch:12⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD57c7c2ea7e02989433ca1b23f94080628
SHA18ee12662ad05f95e4cb8e06ec064733ea18d34df
SHA256a8fe8aedb78ccfba072e8f9d2724a35d858bd9110d7b98f2beeef4a0de4d53fb
SHA51227a4238ad52d3ab3cc679331e04edaa162945c1d424e0e9bcd9da89cbb259257f15fc9cf10a4ea08fd4f32a47cc20e063a74780022ff90a05dee500e7fd0cc82
-
Filesize
257KB
MD5a938254f208ccd7ec1e3116b7bb1d419
SHA1f0e10455e0897d6a787b08350c4dbc84a1926d6a
SHA256e46977ad49ca614789e75e492e3890979aab39c5b0e688df90fc4574379e399d
SHA5124cdc0783230ff55a7cf17fdcb66a9e310e2c4f823e88e6ad37c46cf859762181e95fda8d56db3d7e94d157a32b50394f920a316be79a46d805c9a0768de3cfcb
-
Filesize
257KB
MD5ba92dc050d4b1d0b52d01f2763727a3d
SHA103cb03b285c1cb8f17a267ac5fd2c4b6bff4e786
SHA25689dab88d2b15161bc24a8db703c50fe1b296ae0cc80afc20aa4a1bc50bd36e7a
SHA512d01a23c564711e26874d78dece4e80fe0e01d40197e392e41053fd0d96f6387ef6f72bdddb37852ec23c76795e5518dff8af49d77668632e0e44aa8d2c079565
-
Filesize
91KB
MD57b906d9f805b6e80e466cd05514915b6
SHA1e17c6f903128c2152df09d19aa17efd3a445db51
SHA25652dceb970c334806c941ba5db671539c612e4c45d3f89614d579bac23804e12d
SHA512c9ee0ac92d4663973748117d3c007a2a779723cdc2aff5b55201a022dcbe0e93f9070b81fa5445a2a621ba8bc752efb8ce62c87b9e31029800c91ecb9c96933e
-
Filesize
88KB
MD50bc1128a760b64bcb12cb8379315f324
SHA1e089a2e7db227e46bd951f9b6441d4d6fad3991f
SHA256d46b283583cdb2884bb99d02aec73a3d6e239f289a23df61be62dbe4f8be5cdf
SHA512e4b62ac99c5b4e599e30efb42c149392dec7abb58a360f964bd132dcfd39f1aade4e643ddf3c3b4ea77ce5a7fb7d48d861be415c6c394e290c7bd1099e680ebf