Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/02/2024, 14:15
Static task
static1
Behavioral task
behavioral1
Sample
Grupomaringa_9817993.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
Grupomaringa_9817993.html
Resource
win11-20240214-en
General
-
Target
Grupomaringa_9817993.html
-
Size
7KB
-
MD5
c93549b2e45de2cf87d54298bc980c82
-
SHA1
79cd63c9f944a4fa3ba604f3f2e1f124644983e4
-
SHA256
74eec9a8cd76079e8c216fbf73cdff71b4afea7df3b64b94172d1c5e9f19fe91
-
SHA512
3f19701a9a606b01a3b1aa30f522ae38bf7d7fb192411a294cb6151bd6b084f23baf8bf877b679c6abf7d1e1e918574ae07d088f114a4d5b15315289c304ca65
-
SSDEEP
192:o043n/vrokzA83PMH3WIAc8zOadnPCiUyIHIyS:Kn/v88NUH3X7a1Ph8U
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133529121614175502" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4748 chrome.exe 4748 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 3176 4028 chrome.exe 66 PID 4028 wrote to memory of 3176 4028 chrome.exe 66 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 1852 4028 chrome.exe 79 PID 4028 wrote to memory of 440 4028 chrome.exe 80 PID 4028 wrote to memory of 440 4028 chrome.exe 80 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81 PID 4028 wrote to memory of 4168 4028 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Grupomaringa_9817993.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb2d8f9758,0x7ffb2d8f9768,0x7ffb2d8f97782⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:22⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:82⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:12⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4556 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:82⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 --field-trial-handle=1644,i,8667953388912417741,6325589664892486539,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD50c962dabbd0b99a86951d7ea1d9e88fb
SHA14ff4b943dfd227b3a3b9f03ae6707ae9e4743631
SHA2563c1ea9da9a67a455c0a755062c5cbe78d6ec22d883d557e9a4e4560d7718d43b
SHA5120090fadafa2d94e4f6da58329bbbcf503ff1d628fde520604313b34c944a74e583c3d40e229681abe50b80856f162e3cc3156f6835ed08c9f8dbe7b49d637329
-
Filesize
1KB
MD5b75fbeffb293ebda6419de9cff39cb62
SHA1288103e856f7509329fdb9d1bbe750c002d75cf8
SHA256eccf66d6c4c57e2d84dd06e5c690b000b170c61e9ba36161dab68dcd88828924
SHA512a6d765d187ce9982c7ac763188dcc03bdc3b18ff54adebeaadccf28e39bcf02517ce10ade9c6fe123ba7213fe3a9e319ce9519e111bf2ab679bc57e4ac1d9cb6
-
Filesize
537B
MD56755c17b70ac55d9f27af633cd6ddfca
SHA1838acd3b6a734b82b633372e6343a63b06e465da
SHA2562258fd00bd7796cba314c66740276a34ae3c79188c824c9b6a4f3aa6c5722547
SHA512bdd86f11283d921b61fc64e014f22d88760a1550d72e603b48ec922fd69da3df54997c077a4de29387da4ac9187e760b8a709624e207016af23c0bec303afa11
-
Filesize
6KB
MD599a6dcae45aef79ee5b7823e4daf05a2
SHA1868a9bcf171ee79b6c8e2da31deb6499c96e6ae0
SHA256231ebbefdcbdf3cd7f318bcb83af20ccefe001a95a1ca04a278b4ee16a23dfc3
SHA512bf05122a17f29b0097182655af0cc83c235cadc30abadd5f8dd057e0acc6f8ee6c3322fb812392da89bb311bdc3bd347977d871bba1c2faeb955920d8dcb171b
-
Filesize
6KB
MD506219efda8ca9ebb1b000e679489c1ac
SHA1cb792e8666cf14825146450ec258040eeb3355bf
SHA2562f913a5dad43babf6fecc4ab50bec4f04332b0370acaa9093368c7bde99ce93e
SHA512d69da5c8a13021456e0829e2fcb9f7c1a8e46c0cdb42a7b3b9e7bac085937ff0f429cd2d9203c4a3be653ab3e001840d404755e91d009adee772205aee097405
-
Filesize
129KB
MD5e0267fc258a42acd55314c4f50256312
SHA1f7f322b18f46e80f161e4365ca1b6fe2c46c0097
SHA2565ca06e0ed93fa041710268657a2fea5933de846ab1fda996e8fac2e92ca44b73
SHA5125752a79f6860ab6fa4c8fe04f109ae90f92ee68283481bbf3a05f57fdf03896903f4b9ab322f2e65bad285fd5ebfe62257d10f4f4e3cbaa17bdc871403729d65
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd