Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT-MODIFICATION-ENROLL.htm
Resource
win7-20231020-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
PAYMENT-MODIFICATION-ENROLL.htm
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
PAYMENT-MODIFICATION-ENROLL.htm
-
Size
709B
-
MD5
2d49e038fb0cc34399d404ead89db462
-
SHA1
89f601c31ac5ff246db7e71ce5aab316f8a7d320
-
SHA256
07de8c7c95f36aaa1a89ed983c83404dcbbb058a88b83092773951cb039b6da2
-
SHA512
62d43dfb06a96ba2207a011962266fe65a68f63b1731bd684bf4c6d69d66c5323d26305aac30d5098da605738fe7f12d4b6dad7d6a411ca7c55a96f289c16f4d
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133445533384118118" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 416 chrome.exe 416 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 416 chrome.exe 416 chrome.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 416 wrote to memory of 752 416 chrome.exe 80 PID 416 wrote to memory of 752 416 chrome.exe 80 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 2784 416 chrome.exe 86 PID 416 wrote to memory of 1216 416 chrome.exe 87 PID 416 wrote to memory of 1216 416 chrome.exe 87 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88 PID 416 wrote to memory of 940 416 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\PAYMENT-MODIFICATION-ENROLL.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xa4,0x108,0x7ffc801d9758,0x7ffc801d9768,0x7ffc801d97782⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:22⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:82⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:82⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:12⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:12⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1888,i,14271224203317877231,10611908203652014421,131072 /prefetch:82⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
537B
MD5e1375f0ba5e753c986a999e5d461c99f
SHA10b48e91094b1838ff81892953a74875028f0f7f8
SHA256cb896a523baca69dbcbcb8049dd48bb2878cfd40c46f309fdf936ab102628e2f
SHA5129a3556fb4c7faf37793752e474238c5f5d4c81b38196b6789ba709fc3a28121664f604cc06857ae05c79e6694133b01d4128eb3fb1d1a2ce006a1c39663ecba0
-
Filesize
5KB
MD5d0aee1fbaaa6047209c7f7b212227ae5
SHA13e817f86b3812ea1926eca52792b1f33617ae015
SHA2564ce5d2b93bc925b4cc1b16e1a0dc720b1f3cc8f4331106e19530b48aafc6ece9
SHA5129074eb1c7a66f94d34187dca2e8e8f0bff780b9ab1fa25843d6b4652cd18ed52be1c1a4631a1ca943783f14307bbd500bb9f6a1f6ef06ad268524ee5418c5965
-
Filesize
109KB
MD5d7de8592ae79ebb3c1c270458efcd902
SHA157e7ef82cc2da3f8425822c08ba35d763ce36d0c
SHA256496924607b146643d4ad06257c4254cf023d560b3fc2fe9f29a80cdcfad6bfd3
SHA512752efc158c45055a96ccd838872ebc7d8f06cae37e2e7cd89642a98911cd95e719f36d7f657cb50475362b13b9caabe2f3d51db194cbc9f274a339bf642ca916
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd