Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
To [email protected] 52818226 March 2024 .html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
To [email protected] 52818226 March 2024 .html
Resource
win10v2004-20240226-en
General
-
Target
To [email protected] 52818226 March 2024 .html
-
Size
219KB
-
MD5
440dbc39ad7b737376bba37e536123c7
-
SHA1
9cbc24337ac2987718d5d8bf0bdc6f3fc41eb4c9
-
SHA256
2ea89c339d3db1a9c41754fb8c39e3ea3c9e8186d074ccb2a29b47c0677a5941
-
SHA512
7c5a4e420c10653f80bc76b1924d68aa3c9152d0aa88eedee181b154aa0db164773dd18697f8168c58c3b9eeef004e4d0f1a58cfbcb6247b29693a5b10d8b487
-
SSDEEP
3072:fJ3JcmYbDlcQ6jFDfqfBSHaFufbfYHTHeRGFxqPEHKjyOfQyzgBYsF2ZWScpND:fJZAlcB5fbfYHTHea0JjDfQvzvLD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541837722487027" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 5116 chrome.exe 5116 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 412 3924 chrome.exe 89 PID 3924 wrote to memory of 412 3924 chrome.exe 89 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 4852 3924 chrome.exe 91 PID 3924 wrote to memory of 2292 3924 chrome.exe 92 PID 3924 wrote to memory of 2292 3924 chrome.exe 92 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93 PID 3924 wrote to memory of 3356 3924 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\To [email protected] 52818226 March 2024 .html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffb86759758,0x7ffb86759768,0x7ffb867597782⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:22⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:82⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:12⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:82⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 --field-trial-handle=1872,i,6951157590039345730,6060675524117905595,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c634c463a21a2f6708fe496323289b93
SHA122421729758cb098501758906f3521f76ca10aa0
SHA25672767253ee3901569af3995f689554ca107e0033b304c63e6ce3f8242146bdcb
SHA512898f381e012efce0c171619f7a0d38db732027dca3bf19e7a3da66b108e2ee03872db350197fa42f9bb658082c1d33f414413514ad40612249057d7103b1fffc
-
Filesize
698B
MD50367a18f6db3d6ebd0b16cc0e5bae98b
SHA1b6abf0b42351100d2aa47318c9c5d28667e51a39
SHA256ace1f285accb8dd9b296d3f3f54b59ec72e5b825f17f5079a3e8b0e57bea8642
SHA5124249a6c1dcbe3e2ff2e462751c1a058819c3be3361036e9cb90968e35418f4167dfb0faba9e53fb7f462b0e0ee15ee7b1d78aeff1eef176eb441fa39a85263cb
-
Filesize
6KB
MD51131c67e847c5d39c6f2f6f5cc92531f
SHA1a4bc3b6d041ab519d78a1481beaa0796d2f7dfc6
SHA2560ddeb1d4786204c3655aed54b9fb9f49b9da97bb3e8ee5f3e95f219637822d00
SHA512a0d5c2623e64dd40f4c314b429ae62fc31d8085880f4eaba94c3c47a38a669febe78af7f2712de5fe4491d9a248ec3bc1c317ede76298dfcdffcd997009a8999
-
Filesize
6KB
MD5b2873378f07bb3479b4cd471976d71ad
SHA10da9dc494f12b02a3279dab71ac322c13747d884
SHA25644f632b0f51509bf883956456129ddd463e09bc70d865b0c103c9741eb5f410a
SHA512d0156106b3eaab4d8c88270c13fdd9049267c707242392f31f9a53f9a28449307e6dd95f51dd846ad715e5b02350134cfcdf820480e12e3de41331028d1a2d10
-
Filesize
128KB
MD560f888a358626a56f64be6814c139ebe
SHA1163c8dcf67022021521593831dc8bc888a02d1e5
SHA256e2f9939ab2770d12a62ac97e940fcf2a183539062e1936d06ecd19b02a8c452f
SHA512a7ef990f47fee7aba2563473be6f725c7c70bc0168b43ee9d52083c812aa2405cf92eaf2ed1c9b9f8f92a7a5283ebebd0da2b990765dff26afe553e7c4f0392b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd