Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/07/2023, 17:34
230717-v5kdysdh57 117/07/2023, 17:33
230717-v5ajraef61 117/07/2023, 17:33
230717-v4x9esef6z 117/07/2023, 17:20
230717-vwk9wsee8y 117/07/2023, 17:13
230717-vrkgssee3z 1Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
17/07/2023, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
phishingormalware.html
Resource
win10-20230703-en
General
-
Target
phishingormalware.html
-
Size
7KB
-
MD5
604f9d9d6f739ba8e86799419bcd6b7c
-
SHA1
4fc5f2e2448c3d8cadf716a24d3d943a09cb3ec5
-
SHA256
1d0fd3e4ed24bb808dad25b52766bb7f44c3f7fb64649fb1d6cdba67a4f8a069
-
SHA512
b4cf03ff2cb45f0d368a4c14f211ab5864d67146bc14be3713cc87ea5d77cd7bf6b9d2d6454731bd5c471924773dbf18a1af1210c53dcd44a26a20555bdc1e3e
-
SSDEEP
192:aVHtFvakJ1VxxaD9TiS0We1SyDDtAMiuKdO/nIYpqm:aBtVakJ1VxxaJTiS0We1yMiuKkgYp5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133340876466372634" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 664 chrome.exe 664 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe Token: SeShutdownPrivilege 664 chrome.exe Token: SeCreatePagefilePrivilege 664 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe 664 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 4980 664 chrome.exe 69 PID 664 wrote to memory of 4980 664 chrome.exe 69 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 3092 664 chrome.exe 71 PID 664 wrote to memory of 4836 664 chrome.exe 72 PID 664 wrote to memory of 4836 664 chrome.exe 72 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73 PID 664 wrote to memory of 3076 664 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\phishingormalware.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8dc519758,0x7ff8dc519768,0x7ff8dc5197782⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:22⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:82⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:12⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:12⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:82⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2888 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:12⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3800 --field-trial-handle=1708,i,7917365801278353988,11927371170650804887,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD512e3dac858061d088023b2bd48e2fa96
SHA1e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA25690cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
SHA512c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
-
Filesize
1KB
MD5a2eee3c127691968617f114c1a86d71b
SHA167c7aec467cf2823a689791a7d28df667cc647a8
SHA25619cca88cb64dfe2c69a5c7183a7101974f4b3c5228af8a567b1772b802847d68
SHA5128ecdf4559443814c8c565f47c1d6dde5450c2c6fe31e3d2a0c2ee75fa6adf817435db8ac3457abeb8f2f225c935cb2b98a97e0d790028ecd50475259eec766e6
-
Filesize
707B
MD5637ff58902f109a31eef5cfd797fc21a
SHA11b1830d422e277d06595a345a5075c24f5834325
SHA2566b6ad47feea09dcb81d56138b297c4475e9cb7e6dfcc21660963406198248d1f
SHA512c5ee001752d0b4c96fb3998b5c9de549c32f255037ad7d91a0f5181b376c99a31352e350acfc2997ad19cc15beb77d50900354f707e3bd02f7fea1a9922efb69
-
Filesize
5KB
MD54925800386037c8055f6de745fb4176a
SHA1e2e3278816afff8b63a2741d87a96bea30c68671
SHA256f6f9c6e65e44c4525e7196c723fa47283c37e36afa9a7a06d950e57f29468254
SHA512855958638a3f43e939da0605b728eb4b329f34601135bec3566a36e388f6b3cd184c381fac2a793ef60acf958ab2dd03cf851c6c53c79c7750edbb3b8e2d8a8c
-
Filesize
5KB
MD5f7203b9d0a4f6d255ce2ff989ad4371b
SHA1ffacd8ce69b122b42bb40b40c857f4b584077600
SHA256326fc6c800c4a6b9445b19ffc89eeb345f9d0515b649ce2c82ca53448c556b64
SHA5124ec9bcd7a3df52ef42514ab53d65b19a2097508c7cab26249c2d5dea2589003d4082dddfd01d5aba13f8cc0113f13b4e8708bfa0c03a38eec5f3330abac3044d
-
Filesize
5KB
MD57ba21acd5edd342c7efd809d7e031d13
SHA1bb365ccc0777b2cda00a3715164b78fd08890c1b
SHA2568ea67a16c191e6c8f120e71d004caa7c6afa023295e468dd290041f072719bc9
SHA512a31f67585110c532d64991a186c6cf0b0cbbdbbc9c1a2fa87c29993f9e8bbe39466060336f049b39a4b4c96ff80eca7e3014511c88b4044a84c9afdc4533efdb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fca47892-0e86-4486-a4cd-923ee6007fde.tmp
Filesize5KB
MD5650096fc864e7f45044accb56b8d97b1
SHA1014a0587b114c26c090ded1efae76c883dd999f0
SHA256e6623b0af2bdf3d05f00e61dfd7a40a2feb8050e404ff0892acdc8d0e5e9824a
SHA512a7f0d245d718ca13f22461bb2578b410c792d2db8809ce09c4337e965d357aebdf4d7bae4aeebf9cd136f05f9c219ec3261a6256558df5d00ef0bef132f536cb
-
Filesize
87KB
MD5285f77048979eb663f615e0723305f37
SHA170891e667e78ca2822a61029994062dd52589d8f
SHA25625533b2766321abed62c6b9826dd66137d04faa86fdcfb183789955b2dfe2f5c
SHA5127c3002ae12ef95ce7169e339acf477675343a45ff9d0471d1bdb61cd1aa427ff54f8a5c6fe65c54681ee4434a32bc8e3f4312b05c615e97e133a438f43314ade
-
Filesize
87KB
MD50d5cb64c1dd2f287ebfb543283e078a6
SHA1436ed82b86294847b25ecec219929f9cca8f5de5
SHA256b537d8e2081090bbec0c6f793a5cc38803dad7b6149c537b67f0ae1d91589b42
SHA51241beb3b2df49254ff85eef977ced556a454e86fa5e4ecb5c5969e23cb58c3c46f7395b2f5b5f0239d64b1f4fa9ff617576408b334203ba0f87b3ae3eb7e9ad30
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd