Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/01/2024, 19:55
240126-ynh2caegar 126/01/2024, 19:53
240126-ymgf5adcd6 826/01/2024, 19:52
240126-ylfs7seffk 826/01/2024, 19:49
240126-yjnq2adbh6 826/01/2024, 19:46
240126-yg89ysdbe7 1Analysis
-
max time kernel
1203s -
max time network
1171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
BLANDITIIS6.html
Resource
win7-20231215-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral2
Sample
BLANDITIIS6.html
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
1200 seconds
General
-
Target
BLANDITIIS6.html
-
Size
40KB
-
MD5
0a940d1bfa4b0834a4f2af9080578372
-
SHA1
f4e05a2b419d4caca71747dd174fc77d04821994
-
SHA256
f372c5b6992032699ef6c66177131e6aecd62431cbca53fc9c2daaaae7650199
-
SHA512
1532d9cdbeeedc98eddad3b878dbb98b5b506013c353619cee9020cb7f1e954521375277d7daac76d6eb642ea5180b942bd88f02cb72e639c46677335f654aa9
-
SSDEEP
768:MBL+oAZizxCmaptUR6lUYWGLYrpVKS+3xVvMFD/ajVmUZPIzN:k+oA0zxCmapioerpVKr3PGIVmUGzN
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507723448352011" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3288 chrome.exe 3288 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 368 3436 chrome.exe 84 PID 3436 wrote to memory of 368 3436 chrome.exe 84 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 3928 3436 chrome.exe 88 PID 3436 wrote to memory of 4832 3436 chrome.exe 89 PID 3436 wrote to memory of 4832 3436 chrome.exe 89 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90 PID 3436 wrote to memory of 4768 3436 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\BLANDITIIS6.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b73d9758,0x7ff8b73d9768,0x7ff8b73d97782⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:22⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:12⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:12⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:82⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:82⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 --field-trial-handle=1860,i,6410625867520105931,12864445169422352536,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
897B
MD588927a54c1e97000bedf15c2c76d4d84
SHA1c8364dcdbeb33132fea2a8647d7acce5972d0b87
SHA256ab8d539372c82abf8429d10ebba60a6019ab0a56cbcc94b0301756efa2f3b7b5
SHA51200853e397e1c7dd715544c71be8ea71faae61d06bc23467aabc86db800356c7d0653bda601cd69f1cd30b1b496bcb0a89ae7f4190452af39ab62590f0163efc0
-
Filesize
6KB
MD5198efd40dadc7da854aae34c05f707b1
SHA1ba1a3d32735369defae5274799e3399db965b136
SHA256df294bdd0fb0f7c1b964137d4503b41c1a2cf111e4cfc594a4c7b2d3d0ea7a71
SHA5128b003201f4d1a09003719eab6215df3c812c67c573d262e70120a6c8c1d8a14a9d8f8bb12e7dc536e66db3dc33fa6ddce945ce17cab8214af7f794b3c3ae9933
-
Filesize
6KB
MD5f2298d1778141e63ba5f5a5986e2ff46
SHA1815445142dc12cca04f55347d50220b2ec292720
SHA2560d02c0d433a4a9b3a3cfd6c0b534abc34404ef0f56bfe8c5bcddb9b7de035639
SHA512192b3f32312de7e728881341dc41062a6c0e8a1d8a1235da3fdfc25deba8351446e94892955e5200c63f4aded84470f5948dfcaa08fb378897bca2044b8c74cf
-
Filesize
114KB
MD5dd1b5c85c910c5c5287aa61fd9efff04
SHA15979729a4306249a2259d8a8583d1a3f7a8b2e48
SHA256676f4844224f7f7ac290eb0e65fa277297bd1e0ef366736649ae5630cb15444b
SHA51221bfc19b077ef2f90d9d905daebc46140fd9b3e4662105760553b7dd102774adf6b6cff0afdfa12912080db2fe2671354b6dc07d48fe1cd0fc2efb4e3e4e4b5e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd