Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
1709446527561x378976547485777900.html
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1709446527561x378976547485777900.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1709446527561x378976547485777900.html
-
Size
11KB
-
MD5
e22c386ec8dcd8ec3b99d9a0edddc067
-
SHA1
5909d666a6be1ab0803e2cb82a047e212555b054
-
SHA256
04ecb4ef5281619833dffa2544eeaaec3f0b48b6f73a5f1923a93f371c6cc145
-
SHA512
28b78d56fc889ce176510a06cebe32a3f687b044ef08bb15b232b2c5e7c38b9fc522d965d3627813dd103971037b9c148382e6293ecf9c1980c80b28b64f25e5
-
SSDEEP
192:FO1Ybf6HHEbAlLPiLa9OHffdwWPxmE3zyViw49qMYqeqp8Fq3V212E6:FAYbf6Hk4O/fdwWPxmgzyViw40MpLp8C
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543596244020505" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 5024 chrome.exe 5024 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 4884 1228 chrome.exe 86 PID 1228 wrote to memory of 4884 1228 chrome.exe 86 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 2808 1228 chrome.exe 88 PID 1228 wrote to memory of 1264 1228 chrome.exe 89 PID 1228 wrote to memory of 1264 1228 chrome.exe 89 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90 PID 1228 wrote to memory of 2096 1228 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1709446527561x378976547485777900.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x38,0x108,0x7ffe77309758,0x7ffe77309768,0x7ffe773097782⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:22⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:12⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:12⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2660 --field-trial-handle=1780,i,4859437456921269466,8285591948234773298,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564400183953a6a41fe5e461129ad7132
SHA10791ebc8cd41977c02fa08c3ddbbe4fb3c754967
SHA2562724b6ca52ab8593bfb579c7b9cc2e6f99abcbc378dba90bd8db3d228dba930e
SHA512d3d9f132af69e1a4c27b7f9089210566f7d7daa4fbd1bbb7a2ba80e9b86a8066a3e996af2a650c7ef432787f60ded9b7a6270ec40c92cb4faccafad9a710d133
-
Filesize
6KB
MD58b1bc7ac639f310e009f1d22f99e01a5
SHA1a888667124faee1914b385ecf0ab2ce9761c3142
SHA256bb8804b1d010b1ef1e400574bebdbee5694a579bd54738f10b8cd1e598aa725e
SHA5127d0fd8ddac18bf380fd965c7b24ad8f1b3fa0c6674c8cba8c4cbcc4f5bfec59d3ce7cb9cfdf6b4d0f80761f06d0dcf7e4a94763b933320a5f3b5d0c7a0de4556
-
Filesize
6KB
MD5dab76024e307155feb68a36106ec2b93
SHA1a6d21bbd63021f0cf4f9783de9f5b12ae7e27e26
SHA256d20019120f7aa6cf6b489a169edbc62b32d52eaee5e3f6efd9a7b7824b3810de
SHA51251c762a8d849538e6ef0a9ce24f81e2a9c017cacff9a94d8918b147afd4c94b166d747d1d7e5609058c96557acf0fa9d5420450911ae2c1949db7f5190627614
-
Filesize
128KB
MD54071f33eb65a45cb9988828dd844d271
SHA19554f94b9a8efa4c1f0a787025da6daf7df3c319
SHA256ad8621f3ac1c82dab5104eebd1edeb0098deb02a029d016b9ec39b094e056845
SHA5124301415f4d258144f58ba1cd79945003043c6952985e83710cd19329e13e2e4e6bef8ff976ac507345b63c0317547eb45af6b3bdd986fd3b161710c28d9992cd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd