Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
290s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09/03/2023, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
FW Lydia Signed Your Document Copy.pdf - Ref 820.eml
Resource
win10-20230220-en
windows10-1703-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
OutlookEmoji-1678146613013df8687da-f60e-4f29-81ef-cdea64bb1ab2.png
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
OutlookEmoji-16781466416548d39a82e-ae43-4325-8814-f82a1b26c799.png
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
email-html-2.html
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
300 seconds
Behavioral task
behavioral5
Sample
email-plain-1.txt
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
300 seconds
General
-
Target
email-html-2.html
-
Size
2KB
-
MD5
06e3f656e910c6991dd1d784d60564fd
-
SHA1
71a45ba9ac014e381120a7335336ed3fcd242ff0
-
SHA256
1681eeb720e437638912181f30c6ae93765f95e98aa28ac8f8eb6ccd5843ae95
-
SHA512
45156ba970823a15c86231b3863b7ec5293b3e7a1cafdce4a08558135b43324c36eb7c265cfbc5f344655f118be25ff0af11cfad14bd029352a05e5606b07d2b
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133228530299223852" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 1692 chrome.exe 1692 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3480 chrome.exe 3480 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe Token: SeShutdownPrivilege 3480 chrome.exe Token: SeCreatePagefilePrivilege 3480 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe 3480 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3956 3480 chrome.exe 66 PID 3480 wrote to memory of 3956 3480 chrome.exe 66 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 1568 3480 chrome.exe 68 PID 3480 wrote to memory of 4636 3480 chrome.exe 69 PID 3480 wrote to memory of 4636 3480 chrome.exe 69 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70 PID 3480 wrote to memory of 1920 3480 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff3fec9758,0x7fff3fec9768,0x7fff3fec97782⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:22⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:12⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:12⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:82⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 --field-trial-handle=1788,i,11430865867306974075,18145879711697744863,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5713bac263cfbbaffb4c97ec74f677e59
SHA1c664c4970b0eba6e954431d53f6636c5a78e80b6
SHA256a90173e1dfdae3affd37f23564ab76d29e3d22924041d85e68a9501cd1d39fa4
SHA512a3a6250d7b22103f78bcd94914c60b78133b0f0e22296bc4e38ef07530dbd019ee8159e7dc3d16c929d208d04e774797f977eeb1edfa83207214f9acbdc75062
-
Filesize
5KB
MD5432ff024b6dc4b6a303464727c4f1319
SHA10f75c921e37253e696d8336e00ee0f2adb360bb5
SHA256fc1764c59507cfb2f2a6c83cb49119dc1c8ff63d3db267a0ebde82ecd40a9070
SHA512993197991aba968a8ce28e6e58a1bedc624fc8764fc5d2bc202772d62716393e237cf5234a569b8230395bcb038e411ef3c908882c68ef36edf7d6c36ff7cdf3
-
Filesize
5KB
MD5d0be4494ddb0a6e823017a0a86430162
SHA1a075b382a4fb7665915e202855748ad0ece25153
SHA256b6ea8203bdae8cf9b7465ac1ba796ef3d21c564f5d7cd988ba7c6b8f0170e6a8
SHA5121a9a8b67ad699db390394b9479e6a3d4215d3c2d842277639b11ba994b968501f8eba79dbb2c834796f763c4b31425b071aa6aa1b03269eced8d1e7613d759f8
-
Filesize
145KB
MD52b686cd443a4a5da373c588fc6ae9de9
SHA13c0ee9f5ff89b629d3d3149b6e08d40b2be3d3be
SHA256aa5cc5c07d50da19d79c22e6307b6fa513ea426c3330ceff91f0b9f9719fbc62
SHA5128d0838ee22999add50818555431ba0f202882356637e286bdbaec41e219b45a9c67f00e0d9f9c394cb7bee525bb866846a270296296e7cb0843fc13b9a1d0592
-
Filesize
144KB
MD572908ffac96444616880ea389a0cacc8
SHA1cfd4c17d307eeeb894303825fbf2ec22c2627088
SHA25670e5ca6e2e5f8dd425df9df56e854c3d03b85c53499f1394a95cf1e6dc8aa0f5
SHA512cd8ab6f4bf95a7865161e9fdfb73ad2144605b4d5f0dbf3e4c90876942e7f77d35e7534aca3462cfbbce01dc3ab47a34bcadcc51a5b9e81f4c9a167cf22e025d
-
Filesize
145KB
MD5ae45a701a76f96daba63781346ac7ac1
SHA1bbe430fd3028559cbc211d4f7cf1227c93681f62
SHA2566f779a26f98ee24fe72a4fa21953ac6b9f7ff70955fb3bd321287687390b71d1
SHA51231a2cb6a26aaa8f010cb3b455e666e5b9bad319814d02be5f22d1a029ada0b68ae15a133f4a43c32bb33b43fe74b5b2b136269b0c6e86148295fa0e08924811f
-
Filesize
72KB
MD58cf5b2a6cc092556f92425aa69cb85e3
SHA11b6d0a0fb3ce788d8034f435baa777b1ba683d20
SHA2566617717cc15536502e96e284f13cc160fdba7ac19c3f8f14402fbcc09e64d0c9
SHA5124615646f76dab8417c0dee101dab63734037f48da0695d3e6b0c0fd8245126d5522fb4c0c190a5f054491ecb254c4ef6bcec8993cf0b905d0c5b42f572c8410e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd