Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
1709446527561x378976547485777900.html
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1709446527561x378976547485777900.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1709446527561x378976547485777900.html
-
Size
11KB
-
MD5
e22c386ec8dcd8ec3b99d9a0edddc067
-
SHA1
5909d666a6be1ab0803e2cb82a047e212555b054
-
SHA256
04ecb4ef5281619833dffa2544eeaaec3f0b48b6f73a5f1923a93f371c6cc145
-
SHA512
28b78d56fc889ce176510a06cebe32a3f687b044ef08bb15b232b2c5e7c38b9fc522d965d3627813dd103971037b9c148382e6293ecf9c1980c80b28b64f25e5
-
SSDEEP
192:FO1Ybf6HHEbAlLPiLa9OHffdwWPxmE3zyViw49qMYqeqp8Fq3V212E6:FAYbf6Hk4O/fdwWPxmgzyViw40MpLp8C
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543592383189137" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 5068 chrome.exe 5068 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 4576 4852 chrome.exe 97 PID 4852 wrote to memory of 4576 4852 chrome.exe 97 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 4360 4852 chrome.exe 100 PID 4852 wrote to memory of 3680 4852 chrome.exe 101 PID 4852 wrote to memory of 3680 4852 chrome.exe 101 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102 PID 4852 wrote to memory of 3160 4852 chrome.exe 102
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1709446527561x378976547485777900.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97bc19758,0x7ff97bc19768,0x7ff97bc197782⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:22⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:82⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:82⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:12⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:82⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 --field-trial-handle=1904,i,9571625758145756654,8424265572913602329,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:5532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54b27f673124fd9bbae9b9650ae766e91
SHA106ccdcee1111bef8a8f2a847a52a30057b8a4692
SHA256b7280edd9884c2a9171786bcb84c6e5182b921aa7a76bbf01418d7aa2e28aeec
SHA512f368a2bc39c3663d48b7ca17f5a44defee5e698b244395778b9436b2ef2a799c1aef63d8c124db9e2d5b7bf65faec9b841eb85dda8f8fb15d1f415be106ede38
-
Filesize
5KB
MD5afe2457e1322ccc3ffc5523384439cf6
SHA10af6f5b87badf04c145528b7d7792889f44a4bfe
SHA256582495f37938c374b8780418c9d19eb0aee0f7ea838da3506d55cb4acfe2574f
SHA51236065649e38621b49f87984e21a8aef6bacfb697187091c870c5c61441347b495f8618168bd9cd1c6d81ba7119d10078d251ee623b5c0eae50ff75163bd91d26
-
Filesize
5KB
MD542e579f288cb8d867a2410426c735c5d
SHA18c2ea27591f65e34c989e6ed0da5a9fe9e5b23f2
SHA256836361188dae767f869d4fdb5e75884fc50905320a34aa3fd556ff2d95eb5452
SHA5125d7dc0cf4bc418ad38c9b7ccf58b382c6c81627bf28de23cb317f6d0b868c190e6b30724b31da19c4b0ef2ec001b21e4bc1678063cf05b3cf86f4ac385b6de26
-
Filesize
5KB
MD58da08f16df17336f26132aab23c67d72
SHA1edfc3adc4c9326c49451b0dd381794bc558d06a6
SHA256bf1b2d28d6496a9d23c1ca895bc1304ba5f4a8b620348d6d56ec31ab000ebbc8
SHA51232dcb2a27ee5e1c437e35e84a4aa30724581fcbfff048ad08b7aa5c47491a90391e2262ffab51c2ea13270f8cbbdd1474346a0b98a16ca9b422c50ce21873da6
-
Filesize
128KB
MD5f34d3c7821aa7e5c102b60ca33978a93
SHA12bc6859a345b617b73850f284b118fd34b0cd095
SHA256195ef2219404b9c0afa162864e37e723b2b7f8ceb38e33e68c3d259b9292cc56
SHA512557eb3b026a930ee8d191db160d0d0d76eaae83ed4ff3a7b101df14eb0c733d60449b9fd7fa928ee4d00ef16cfc5ffe78f66baede5bc9e15f6554142e436d796
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd