Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
09/01/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
contact.html
Resource
win10-20231220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
contact.html
-
Size
169B
-
MD5
3a924587a03eb36516ba715c384e5267
-
SHA1
a05c222768c2b7049ea9d8a745c582438b748ea3
-
SHA256
7b1c95f117802a1767416994cc254fdfd7d2a105b58f25de5f9bd3f4660718cc
-
SHA512
b7c3ae76093e1d71dcbd9e53ef5bb89d3f69db22a671f73802755d84e8820384eb554265d7061e934e2273b68d51d4951a9cc664d1cba45c7ae8578c0d61eb4b
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133492732715476719" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 3524 chrome.exe 3524 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2768 2716 chrome.exe 54 PID 2716 wrote to memory of 2768 2716 chrome.exe 54 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 3204 2716 chrome.exe 80 PID 2716 wrote to memory of 4512 2716 chrome.exe 79 PID 2716 wrote to memory of 4512 2716 chrome.exe 79 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77 PID 2716 wrote to memory of 4524 2716 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\contact.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb9d7d9758,0x7ffb9d7d9768,0x7ffb9d7d97782⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:12⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:12⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:22⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:82⤵PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:82⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1808,i,17305658453701420145,140771565043166755,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55415fa94ee7013401533efdda5521b0b
SHA14c030e8825ca9b2e3d028548cbcfef408b4dc360
SHA256ed4c083213c2141a7da9649b0ac717b5afbaa23b85b4e243aaf5b21157e7e00d
SHA512e309c37ca96b4c66bdc7488e7c42f7c30da1adc13c49a286f5cca2d4f4b78bf090834a55ac2ea9765e760e13189bd86d49669c771327b77230cd0de6996cd078
-
Filesize
6KB
MD51a464b5975d9299f01d17a6656521c06
SHA113918a7d3cdeb57e523a90400b520c1b8b6776d0
SHA256f62b46ad15e7222e94157243277293b75ca9e7db54f24487570def39eeb35d4c
SHA512ba87c6d14a81e76fa96a3d2145655dd8a5c081977bc99a30f690749c564ea90d33475d777082c95c95c6dfff03bec455effd36c01f691dc542ab198d051a1225
-
Filesize
6KB
MD560236fc0c605f6f58cc07b8a5c46c8d6
SHA1d87233b373df6f62525a8ffc16aa607f6905ea8e
SHA256b1b97602772a0d473910ae69e425bbc23c47ffa6d0db1dca40ba03d19d0b72e5
SHA512f83e065dd6e8d46cd3a21b8444283b28a3f13afd6753817d8f938ea316c1c7b2736718a0c20ca5d7e8600b6f64644ce32362706d1709fc2df0f92cd2c090a498
-
Filesize
114KB
MD56b644057ae903c78c429fcb75bcf389e
SHA1c63cd5a390e87e288d19d09439607e9fedbb60ff
SHA2568cc0c48d395831d5e921d22b811b81378dc57e6461be16185263297bccbcdf2e
SHA5121191d78c0f2f5a94a36cc90ad450a987fc819900e5497a59edabbf31562959db073a218a3158f2ca6bff6400b0f16aedcd4f5dbf676fbc2d20ed4f3897d8e1e1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd