Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
20/03/2023, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
virus.html.000.js
Resource
win10-20230220-en
General
-
Target
virus.html.000.js
-
Size
40KB
-
MD5
9b38cf5539911f2610337602ce079f10
-
SHA1
6fee5029439db2a500f4efa7ac1f9bcbffd3bd54
-
SHA256
fcc3c9ff7dd2882127049a86cd32b7fc8b8bb1ca1d1c10566782a919b6148106
-
SHA512
46253f7e2c2a7c77f5286760aba6d6574aea79823a5e0828d404bacfa4e59460dfbb7b9a30a8afdbdf1ab147bcb83f1a880a488c074b5dca3b6ad62d2fb6bca4
-
SSDEEP
768:Hu+y0SZahMcoJc8y9yB0FprU0428AtplIhO3VdzvlS0Yqb03T37uMwVWgJI+xyPg:TPshbuMPveecyeeRueeeeeeebweeeeeE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133237968713070846" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2168 chrome.exe 2168 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe Token: SeShutdownPrivilege 2168 chrome.exe Token: SeCreatePagefilePrivilege 2168 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe 2168 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3984 2168 chrome.exe 72 PID 2168 wrote to memory of 3984 2168 chrome.exe 72 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 3940 2168 chrome.exe 75 PID 2168 wrote to memory of 1424 2168 chrome.exe 74 PID 2168 wrote to memory of 1424 2168 chrome.exe 74 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76 PID 2168 wrote to memory of 4832 2168 chrome.exe 76
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\virus.html.000.js1⤵PID:1568
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1512
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\virus.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffdc9a49758,0x7ffdc9a49768,0x7ffdc9a497782⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:82⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:22⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4272 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4316 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4740 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:82⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4268 --field-trial-handle=1728,i,9219284210539273344,9181438819127929445,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3388
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5980d8101030628bf4852f1a2c8a23691
SHA1ea177005a8d8bfe427f9d2a82aec562f79a30344
SHA256e9e746966860b0a217b4e05fb9635856f64ec746928432d9b021ab2dbcd75564
SHA512aaf9ee109797e8082df9f21f1015df080e1ff065d22b808ad6426dd4915879c8eaade9eb46278a0bde276c4f0c241661c5c40b291684181cce723dc0f26399a0
-
Filesize
2KB
MD52efbdbe745d0a3b4224b4e1a0079b690
SHA10bb9a0e4f889fe95fc1ba2c34c26c2408d40322c
SHA256bbb1f2601f721b57ca3ab3be6d4fed729ba6c72f700ad15696438af5cb1f60d0
SHA512b4031be5365b4eab46bd36876ebdeb4469500c10626b1bf99823b880f7b7e983aa9e649a4c38ddd929d25c0db8064d3d04a5d57a75f73afb3dca7b4999ecea6e
-
Filesize
538B
MD58918c89db7a56a041b6e8ec48e9de9fa
SHA101739b059cf04e61f5d486be20633cfd3841d5f4
SHA256000ce1eaa4de58067ab6b4798f2a9f29d947555bc79dcb997167a020b606367c
SHA5120cd03d0789a759a92bfeb927be1ee85c8f2d22769b1acef1556095f1e24cfa87a1976f5af8d1109dbf40dda540d0d51849c04fa2af51b00fbe324d741e7aedb8
-
Filesize
5KB
MD5a34212d4793574a21c5dc57dbbc45449
SHA11012cfe9edcf24706b0a4adfc535627ddef1325d
SHA256745096d9e92e78ae95484e3172bbcfd2ba4854d276bf03b92835d108e3b7e15c
SHA512c792159f590c0e9b0d661b41ed00836cf7c0354f409d9f998f93956f56eb2de3c562a23292cc90d1fee5f88e7c9ea40ad999b6c56e929eee0ca7fba3f2cdd5c5
-
Filesize
5KB
MD57a627467c816bc5cc0e8ecf6e2afbd6b
SHA15fea5a089584e8786e0abf0c002b67d8b21ee575
SHA256e09f24572ad33d8b9d718a9a36441e7a72ae4d2cea24a5f9550b9f606d602604
SHA512f0a1f50538a2cbabecac22b79e7f354c0cf33f5cdcbe6ab36eb8e05704c24e2fae685c17f9ce48c9ab1b44ee0613022ac0ea12aff1fd1931bfbc5cb291779b14
-
Filesize
5KB
MD556caf384a1d6f95bc7e0828330c9340e
SHA168bcc4da33f2e4a7d42523e4516479bf150c8bdc
SHA25657ef582721d370d40676e39923876bb63e8fea4d1700552fb5af92966ec5a650
SHA5120af8eb55a720a9b0b786ecdbbfdf6b84140a0c8c5232410327f7254a0ea37916fc6376cd0c31ecf7baf27ae6f000cb8474356f2eb707d79527ce44c4ca1a962c
-
Filesize
143KB
MD5224e718cd62b65fd3f3a89a973036988
SHA1d11d39aa30232f09db2c36440f0563fad02d5ba9
SHA256f8f718af9e48440ca465f8ecbdc2c68b19ef77f8cfe5dc258aa22450dc2a78b6
SHA5128ac2e81de197e34c4478445e4586f8cb263881ea86f9abf267d7153807929988deb0c1656b71e8b5549d728c41cbe596b66c9eeb3001d825c65f6c68e65bd705
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd