Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
My_photo_video_2023_№7567456.html
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
My_photo_video_2023_№7567456.html
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
My_photo_video_2023_№7567456.html
-
Size
2KB
-
MD5
bd7b63ead8e40cb68ae5e1b6cc41039c
-
SHA1
c1e1e81bdc45e1633a46cca278bd12fa4f5e13ac
-
SHA256
d642a27ef042746cb37b6576fcaa6284a93efda96d77c5f87617fc5f53b46b88
-
SHA512
f79ea9c973321750b7508d4d76c8da2f640fdc45a191f04c30b35fb72342a7cd15aa6a01302fcc72448610a96becaa65d3dcd8d5b3df43ddce0778b7f84d3965
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416066477761047" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 720 chrome.exe 720 chrome.exe 1624 chrome.exe 1624 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 720 chrome.exe 720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe Token: SeShutdownPrivilege 720 chrome.exe Token: SeCreatePagefilePrivilege 720 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe 720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 720 wrote to memory of 1060 720 chrome.exe 52 PID 720 wrote to memory of 1060 720 chrome.exe 52 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 4908 720 chrome.exe 87 PID 720 wrote to memory of 5108 720 chrome.exe 88 PID 720 wrote to memory of 5108 720 chrome.exe 88 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89 PID 720 wrote to memory of 3816 720 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\My_photo_video_2023_№7567456.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93fe19758,0x7ff93fe19768,0x7ff93fe197782⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:22⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:82⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:12⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:12⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:82⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 --field-trial-handle=1864,i,9227954066158201014,10617538239332585223,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e9f24a38ba8a6c6fb60c7a9f25474e2a
SHA1fb82b4e5f1cc88c3589b4b6e178a7b1e4aa071f3
SHA256a01b012091204b392fdb7ae1358890e5bb8fa70e5205944d6461bd21e684cb47
SHA5128ba45a4a9e2a2745e7e8310b149b18507a7ecf6904eaa8ce7a50043b8cccd1f577f570a7dd9048c5c8c10f718e915d349e5478f0b4f94c34b0fb7eaa75dc4751
-
Filesize
538B
MD5328733096fd2246e8ddcae7fc659d00c
SHA1ac8efb3a1b41576806f378c2c689f7c3232a9d7d
SHA25631e93148cf01089d15695216c8e928c8b423152b88c621a1583e48dbfe0a41ae
SHA51207748e19c9a01d66af8e88f70f54777e793b6426378445ebe3128eabb2c881252fbb6c458a5840c911e42692514d0ee2ade3dd1f07ab43ba096f96deede19545
-
Filesize
6KB
MD57ef793ad9d3467c22ea7b94f1c6b94dd
SHA17b561a8508e393056c4838265300cdfb22ac92be
SHA256836ee7ae30b2ab0dace4a32a7ec736505d76d70a5bca32acd64ef73be78480e5
SHA512e48568aaf05636e1b672cab77070fafacbfe51cfc597c9be60eb7cd181bc4587672249b465fa0967ea5418a55714533cefb20abae6d0cf1b7aee2308a6aba0dd
-
Filesize
6KB
MD51da3b1d854fcf6a9d8b7bbe1ac5ee9d9
SHA1503f4fad3ce4097a1d9c8d490a093d6203d0bf0b
SHA256c343a99e56fdb6edfa2bb51ef86a0c012465024ae0b994e6d4435d7abbb9c61f
SHA5121475ae42925a78b4d14a068adb64df644912dba50799d7f13812f2692dd2db6b1822612956a883700c8a3040e7491bc28555c7763ecde9cefaabf62e6b76543e
-
Filesize
101KB
MD5ac7ea6e376b599ea407f40eded5af330
SHA1b5907306124dc4082e60a9c196bc1fbc21f2145b
SHA25663b5bca4d79aea4e962cd8f622ce6264c20b71a86be9f968c18b3c87bd65ae4f
SHA5121e83763e40f31c3144772852b9b63d781f7787bbe9960ad56bd336cc049b42234b6d6e72e2fb877823073fc5a90764a7bed0b5cadd0a95b502ce10f4427461f0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd