Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
.html
-
Size
15KB
-
MD5
65cb7e02cea46de928836a8d4ac8959d
-
SHA1
c465fee453b3700f1c3d362866887ae7c025492e
-
SHA256
bea9521aa546912b5a684b51ab835afa44d718ca60212c60f93f23ec7f8a3cb9
-
SHA512
74b9588dc59fb7d10b9dc35a3124fbdd8e40fc29d65ef3c431ea81910a576c7c7a303d67e3406e153a72ebbfff5c56e6ee1a48a8be5250fabff02d7534cfcd4b
-
SSDEEP
384:x6j9HlAALRcomwFfNmBSZv5HvvQ1TCxzbEMhHPIKlkT2zp59FqJPku7:6SuxEDkC
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133531213500591112" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 1964 chrome.exe 1964 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4492 wrote to memory of 3500 4492 chrome.exe 19 PID 4492 wrote to memory of 3500 4492 chrome.exe 19 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 2212 4492 chrome.exe 94 PID 4492 wrote to memory of 512 4492 chrome.exe 91 PID 4492 wrote to memory of 512 4492 chrome.exe 91 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90 PID 4492 wrote to memory of 1896 4492 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce9a09758,0x7ffce9a09768,0x7ffce9a097782⤵PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:82⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:12⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:12⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:22⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:82⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4576 --field-trial-handle=1812,i,11453657352339445261,10904960604429725511,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\011f4563-8923-4a9e-bdf1-d2bf062af518.tmp
Filesize6KB
MD5eddc873d1744449a9a9b692030ece2df
SHA18bac7ab11243b70cd63e4dead5d11a665d6e2d17
SHA256e2a7b2bb001c7c8a2d695992b65781c7095b229bd7734208f97755d88b32a408
SHA512ebece348b2ebcfae21ea99ab73a11e5efbfaabeb9c215179aeb6e907d26d1e5b626ae22ce5753a621c4871b9d50a4c4d853dcb6af1f5fc24bb89d4869bad2f84
-
Filesize
6KB
MD5c24ce3572c2c7b35dada16eed0432a44
SHA1868c69ec04a9fd57641097bc4ad2eb06a0b60f28
SHA2566d953563e4b48ecdf44daf99adb025317c9934d0303ef2129ef8df586547561e
SHA5123cefe4c48f7bac09e6de16cc4c658c9f22404652b62b24451beaf88d5dc4272579f471ff317a8192d3499d835b57a7350caede3b0dcd75dd9436d2283c9e7114
-
Filesize
130KB
MD51d9df14eed288269ac6d57f8edce76bc
SHA16c8e97b12240fb972fa105c27d0a6f6104182270
SHA25697ad40961e982fb82007c1f87aa61646d5c09368b901f748b29c97a93a527198
SHA512e46abe43e03d20ad07fb94439fe1a6e9790f75074268f4278c79dbc161510af938b39dd4b5d8c0a680b934cc86525616257719d03c377cf13db799dc0277dc0d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd