Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
Receipt.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
INV-2131.htm
Resource
win10v2004-20230221-en
General
-
Target
INV-2131.htm
-
Size
146KB
-
MD5
ab7ed4d0e72ac79793ea50f8d0ddbc64
-
SHA1
3be9af842686d24abd9573fcfb8a022dedb650d7
-
SHA256
85356521df25310652b87cf1ded54974a6ab506ef9d71ec52ca3debdeb408370
-
SHA512
1cc77fe0e573aafcb4330d3becb5cede4253bec069e1aa830347a535d310a84bc8d446c7f2d51570b6f7c577f9f43de783754dc0c79cb7a2eff078d280c50b8b
-
SSDEEP
3072:bKVvr0NOZ7hFV+yw2B1IyiCFJyrISwVAx8ZoyFF8feTIh1DYFmsxyOhmX:bwZVFVmCPmx8ZZ8feg1DYtyHX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133265758198258749" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3752 chrome.exe 3752 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 440 3040 chrome.exe 83 PID 3040 wrote to memory of 440 3040 chrome.exe 83 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 4576 3040 chrome.exe 85 PID 3040 wrote to memory of 4576 3040 chrome.exe 85 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\INV-2131.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeda999758,0x7ffeda999768,0x7ffeda9997782⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:22⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:12⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57eeae625be9ad54390169ae0d5ad2c58
SHA1f25f33b43733e471c834df117f91edaacfde04e1
SHA2569e351828a885dd7b35009452c3d22875cf956f5f7b30e0e75372a254cc819c17
SHA51214352337ad9a0df759b21cc22b574c7de044999d0f0faf25825ab99d4c1e31c3344dc138693cb1118fed3888c7639e45973aa826edf6f0cae5508220d11df7e5
-
Filesize
6KB
MD5807cfc56a30d1cce93f7910dcabf6f7d
SHA1ff8ba9cc9e56f6e6f1c8e55915ea77ecd9979e2d
SHA25613b5a6923edd16bfd49cec5b7284e3a0f38974c0d58828abb18ce7e3f7230b2f
SHA5122abfb9ab44e471f1e442a54999553477b21c0cacb069a09e0ff29bd08da908e2c38dcad105e7c1d16127c4f4d142ea5373ad7c6331e38b5b100464fddf6bc7a2
-
Filesize
6KB
MD5a48f5668c05a2b61ff2a75b819d808ee
SHA1f52f442d406bca2c9af9d0ba4ef4a048e1f018a2
SHA2562815033645d92ff182dfc9f91773bbe7571b33b034ece5cfdf0347c4da248765
SHA512682ab2c33bf93dcf79dfa956bec6b1b60ccf1178d4e5eecd2d2f5ac7afa28851c84a6d8e0ea3335e9323bcd077c31eee75369c842c2e2b51a7bcd559d2a2754f
-
Filesize
15KB
MD5315c19a82f59bd5eaa068f701b56c055
SHA1267c54a1fefe332ab16c9952f70d4598cce222cf
SHA256639dcae3f25bd5e9eb608d0a26fb6d2d42ab32be846e057f678a58f7733b4645
SHA51227e2704a7ec8fae16b5d587d9531bb2a325c0a46ef1fd7f3f8c323d0a3a2bafd355775b63789716712dc28698759206cdcc0cf251dd4b4d934f25ffed6a15662
-
Filesize
201KB
MD53679e3f4c2eb2802f7d8dde2629f4385
SHA1d47520664378d32e305fecb45d387f8c33023e83
SHA256c83ec8c8c16da8775698ed6f899b043666623952a541d11708d86583995eaa21
SHA51277aaff2b56b785da1d7561c82819f4c27e9507f309b7fc4b6d97b6c2fa3e2346f0d8f9a7de043ac4ab67f7ff394ddde65658a132c868f23cda20b2908539b925
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd