Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2023, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
download-thanks.html
Resource
win10v2004-20230220-en
General
-
Target
download-thanks.html
-
Size
45KB
-
MD5
016db73fb776dda17734fc6422562c1e
-
SHA1
657d4a97d90285810ed7a271a9163c65c131abbf
-
SHA256
3e51c997203744fbd12b52e2d259c5247f2ad5476f82e1f50a700f6621840470
-
SHA512
cce5f839ba4e61f4b2dd9facacf99e693bb7210bc779cea28c1bbf69584f232b4dafd423b9553bc4a7968d91ee3edec1b94f99bc05e29480bea30ae2b9619e00
-
SSDEEP
768:NoG5IDcIIAEptDemJmSs7016jdcfPXSYkxaRfaVBvOE68p8LAr1ZgDuLebbp82PO:NoG5IDcIIAEptDemJmSs701Edcf/zHp4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133231763438510040" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2192 1508 chrome.exe 86 PID 1508 wrote to memory of 2192 1508 chrome.exe 86 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 1916 1508 chrome.exe 87 PID 1508 wrote to memory of 4576 1508 chrome.exe 88 PID 1508 wrote to memory of 4576 1508 chrome.exe 88 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89 PID 1508 wrote to memory of 3604 1508 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\download-thanks.html1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85c359758,0x7ff85c359768,0x7ff85c3597782⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:22⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:82⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:12⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:82⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1824,i,647554449104307796,3405770419922874127,131072 /prefetch:82⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54d7af11e10e44f2adac4f0b136f39171
SHA193461cb9d03d1867a287de19d6a9e26f59e40b02
SHA256440cd41fe522751cd865ea397c243bcc9402456e988d039f6efd2357b23bf3de
SHA5125f8ea0e2be906050e21129f3084cfe350deedc4e30032f43efcf6fa259c5c5967e66dfb8728fc1445a5abbc1e3bd8077b993d46454a11ada2a63ecd0904e27d0
-
Filesize
705B
MD5a71e1ecab4c47229bdaccf2221776538
SHA129b46351ebe16014819f2ce6c7ac3d0ee9899b7c
SHA2560f00928d8c467cdeb23bc7b9de88a98ecd1f81a0b0dd8f5ea149c18f1c7c4657
SHA5123a950fd6dea6862074b1d483fdab2bd993e14e6368e4fbd1b493cfcae3b615f3dac28739f4f7cb16ef0482bebd1b47b3b5399480fa1cc786eb399ad751304e48
-
Filesize
5KB
MD54e7d810f76be53099ce3edc5dade1f5d
SHA11d0f32ea497fa928142ea948aa0cdd5162281313
SHA256299a37ce15005081b64c380a451f475623cd67fff7ba987eda60b43187997d21
SHA512f021d4a9faa6fbb9c9096218663749db02023e74c38b7a4534ac12d34060172bfbbe965c4cab06b8dfe335e48000d1ad19dc80f2f47280f931eb873e28de0bb7
-
Filesize
5KB
MD5c694e315daddfb4ebbbf6aa535d0ce54
SHA189a8487893036f147ca93911ece429e75cb0e698
SHA2561ed3696dbefd9ce6215dc548098f7254384f7eef038b77d93c2356f1d03a60b8
SHA512a4761dd8e90600851bbf9a6e8c1aef609298ec1f3839e1481b27aeb8f957b5f1b0b61688d4814fb16bda07f69b462f8cef12ec659e3b48615c090a8a3b5fdc44
-
Filesize
264KB
MD52697ef53ceab2e92eb033e4931ec89ac
SHA1302cac7b7015056a5a7ab3389c38117f9a74d939
SHA256b190d2ba56d284a05abf3ba9040dc5e9b0c05337e596b1f15283ab33b0554476
SHA5122c06623efedb4e0300ee710e7d8d921e9f8d96eac398d38b844b0b78df54f715864dd95b8439df55d890609c15203a3de5daf5c90b998c40525957a950f6a7de
-
Filesize
144KB
MD585b66890d8753ab7454f331299cec58f
SHA1924dde2d602d7981524f1b089144a743e88d0950
SHA2566586b9aa4c37d233023641372a24c58627b6d295d0c9176bbd3205b692f97dcc
SHA5123e616dfec11d32b1f8be4bb9d44f27234d744757b5a86ab4d921379d9db28a0b0d896ff3f8504a37b38737461ccde40c0c6fe7f0d87cf6f0f3b00fe70dfdad4d
-
Filesize
144KB
MD56306e605fee8fbfaee9d26297397db59
SHA1e4d66404778f17635e1ae5b37ba36c2f54a6ab2c
SHA256ba32474bbcbf61269bb906a566ce05d2ad604e06960f487e2c7669dd93eff07a
SHA512196d6accddff0521f17c04413d2556c488784229d9e2fa1eca24af863a285082ea583598daafd23cf4b702527292287053ded3763a8d328f274d1ce6584e4465
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd