Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/01/2024, 13:55
240110-q8lzqsgfgk 110/01/2024, 13:55
240110-q74hdsgffl 105/12/2023, 14:24
231205-rq4bqsbh77 705/12/2023, 14:23
231205-rqbxgsbe6w 105/12/2023, 14:10
231205-rgypwsbd71 105/12/2023, 13:54
231205-q7rtlabd2y 814/11/2023, 14:09
231114-rgcgnacg7s 6Analysis
-
max time kernel
112s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2023, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20231201-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20231130-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
.html
-
Size
14KB
-
MD5
cf9283c6d5b9f12e3834dc202b82fa67
-
SHA1
b49cf7a36baadab49b38b16b60e82805a62684cc
-
SHA256
8b5a76c03b0494601a599296a59cefdcaa9168527328edcefbcdef703c4e3d0b
-
SHA512
c4cb83f0e0a261df41ef046799073750c92e2d368c4b29151ebc4c78d83a1dd32e84ddbf35df931861e0ff1f5e4b7a4f5e9871fc121bf3c24653f1d0bb8f82f4
-
SSDEEP
384:rXvNgIfDpmRgVoOsKHElKeGMDU8Hhhb0vmx28cSz:r/5fVoOsKkI1M7Bhb6mdB
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133462590829709680" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 3096 4432 chrome.exe 37 PID 4432 wrote to memory of 3096 4432 chrome.exe 37 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 1964 4432 chrome.exe 91 PID 4432 wrote to memory of 4904 4432 chrome.exe 89 PID 4432 wrote to memory of 4904 4432 chrome.exe 89 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90 PID 4432 wrote to memory of 2636 4432 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff91349758,0x7fff91349768,0x7fff913497782⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:82⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:22⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:12⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:82⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:82⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=824 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:12⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4136 --field-trial-handle=2056,i,12375436754160051135,15099634906864227034,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD53ab5685400a25aa39da6c3c8965cfced
SHA18ba4c8c8bd25917072cd17117e5b993173de3525
SHA256e3a5f1501f18856107a27193da98604fb899b5642eee9470129898ea9b1766f3
SHA5124a1ccd2fd8477fab36cb5b2bc27499f779d313f77e1ddf160cebb559b4396205f20f00a1b4b2c0a79341d0dc47eef7f0e94304346035f00995a9ac8e2555ed1c
-
Filesize
6KB
MD56c2d543590be72239fe50d5e3e90b9b4
SHA1b7a28175cc148b15f7ac374cc491179e5666d32a
SHA256769b8df7bce7e497c0a8d16a7f5d55799dd8572f495284d772ab53d1f8cefcba
SHA512ed7019458504173d876cf9cc63b88ddd571157c803648c95df838bc6af13c90b9f2479bdf3b6fc0ed775813b4c1dd0b540091dce57f327bf4c2da6194ea3cee8
-
Filesize
115KB
MD5931de454f988c16d857707c34d0cadb4
SHA1e9e3586e8a12a04ab71b225f98f05cb5d0407549
SHA25639ae0cb416752518b9b169d70a410982787b5aa707c5951c4b9a13e32573fbcd
SHA512b8dfbe68cca3b23e492a3e038d862565c8ddc807904d313e0e47d70967b21408a4101df6ccc72222de6d23efc433e4925c2b6265efa79c71d909d82613b379ce
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd