Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
290s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2023, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
ATT00002.htm
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
ATT00002.htm
Resource
win10v2004-20230703-en
General
-
Target
ATT00002.htm
-
Size
852B
-
MD5
e797544b73c11094820d02517a03e7e6
-
SHA1
53c26880ac8bcf06287c5076448a6293906e6155
-
SHA256
ffa29720931f706c5f2d805f483230c7d4082922f6089838d1cb9bae6d1021f7
-
SHA512
6ac646c50cbdc10e825e04234852025b27940924a821a55bfdf5f0f3471b38b1efa303857b0a480abf4080b78dd7cfd0a20207a87d37a348e379aaac6f5839fc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 732 chrome.exe 732 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2380 chrome.exe 2380 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeCreatePagefilePrivilege 2380 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 4208 2380 chrome.exe 79 PID 2380 wrote to memory of 4208 2380 chrome.exe 79 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 1204 2380 chrome.exe 82 PID 2380 wrote to memory of 3400 2380 chrome.exe 81 PID 2380 wrote to memory of 3400 2380 chrome.exe 81 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83 PID 2380 wrote to memory of 3676 2380 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT00002.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff944b69758,0x7ff944b69768,0x7ff944b697782⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=312 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:22⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:12⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:12⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:82⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1708,i,2686425863891742512,8555856168230647965,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:732
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d12bb9cd9f58d2f2fc9be9126c6cf7b9
SHA1cc9317672052d9460611526ee06b67c3f6b3c311
SHA256042333f051e11ac4e55822c9df9474ddd49790b0a8de5104f2657841d9dca266
SHA5124326846b4ca903533800196d0b8caa7ee402cfd736915be0d2605d44285b6079f6f1ed10857f62cdee316d9dbf7b5fd4347f267a10427289afb310cb9be7a391
-
Filesize
6KB
MD56ae5d9d45ddb09013fbac2536da2f241
SHA1799f4e96a4a51974c5e4b52d7a0d389c86c59969
SHA25691add9c583bb6b6ced23945a4e2598d2b3330410db12c914cd4ff743ea7f326e
SHA512de8b0183d08689eff311ed6a5c46bb5346d887a9c82bb188f6f061402c64fdf0280effe52514c831450280dcc291ede076a953dbd11f04857bf57616bc015304
-
Filesize
6KB
MD556971495deb7daff768b904ee30c8124
SHA1a28f55141801c644b5f393780fd3031a1f22df11
SHA256d2e6661c91979b5ef77103cec31a2aec0e205ff3272dd66e431a8b4015c77e0d
SHA512f4e021face36fd64717a956945f85fdda583ad8d61ae23b184aeb639630996cf1fe92cb0fd8e4f24f3e537e9096b3aee5a3f16034fda6dc64f6f318d7c0a109d
-
Filesize
174KB
MD560699b05bf3381cc45a8226769fb400d
SHA17b3314d5812039ad02844ec24e3638d5b4d43ad5
SHA25663131c9906d268a6bf168ba3fccb6691e8af1d34245821bb6d31d77c2fa3e534
SHA512eacf8a5e43f4e89c5b7e62a31971187ab5f8d075ea921bb2d7a67627e0ed8aa80df68cdd92a6c016fc55c988cac4889fe6a0d0bbbc082251ac4a00cdaa5fc354
-
Filesize
173KB
MD52da7db4ef0a14a1dfa31223f0b424714
SHA105d6a816756f4b1e120e9618d72f352102925af5
SHA256d92b141c6ed1e45ad5a2de18aba2e5e70c5714ee91d92231f83e84ae67cbea8d
SHA512ac020a4b11205c88898e132041db493158e9915d76949d457ad054c19f274a25f06e8a3d72995640148bae29d4539af8e6c475e10f5dbc38ea7e7c61f1e03b55
-
Filesize
89KB
MD5f00bbbb9a662c1e3567555245af2f378
SHA17b230627214e03edb063d0871f37b6ceeaabdc2e
SHA25643e6d352b16b275b79db09e110649e3112c4481132492f222bf8dbbde19e76e9
SHA5121d910e3a1f4237fd8825d422ed88b9d204cd385c273411e1edc7a0fe68cfbfd6704beb3295d16670ef8f7f6e0b3cc349122599283e570dd11610c9a98163ba26
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd