Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/03/2024, 18:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tria.ge/submit
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
https://tria.ge/submit
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544818617138951" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4612 chrome.exe 4612 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe Token: SeShutdownPrivilege 4612 chrome.exe Token: SeCreatePagefilePrivilege 4612 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe 4612 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4168 4612 chrome.exe 79 PID 4612 wrote to memory of 4168 4612 chrome.exe 79 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 560 4612 chrome.exe 82 PID 4612 wrote to memory of 2928 4612 chrome.exe 83 PID 4612 wrote to memory of 2928 4612 chrome.exe 83 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84 PID 4612 wrote to memory of 3380 4612 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tria.ge/submit1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa90cb9758,0x7ffa90cb9768,0x7ffa90cb97782⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:22⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:82⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:12⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:12⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:82⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:82⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 --field-trial-handle=1756,i,12706904582478609570,8156642514474072937,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD51c97afad168802e7fc237deb42f39785
SHA1954559cd42fbac111d6886f09e4082ad0d7480b8
SHA256e45f21b7392b5982ad8599204d6ea56cc9ea1247dccc06b32bceece6914c3310
SHA512a4d3009ba509269c12a515c8872eb916f57ff723efcd305dfb14ba98d2b0d5acb2a747e8d8e51c33c627ab0fb38926ec3f818c9df2a6bbf8da256a1b15f9680f
-
Filesize
1KB
MD58ee10effed698dddba69d86ea6ce9843
SHA1d88baed61fc0724b06dffce27fd91c8bd2eb92d8
SHA2562b1e54ea63b197c95e0a789dcd0477bc4be4cc1a2d3bf24f8bcf8abb4aadab6f
SHA512fed593c144bd1d9748266127723011a27565435bb9da2aee89d6be0b44cf64c6b023352e412a66c687ead124fca618ced6d7296620250443e9214fa08c6af0db
-
Filesize
537B
MD516824932c5ba5aa46953a0960036a87e
SHA1ed48c47504175d49dcd409cc9c0dd539fac2f832
SHA25676878a79fa4751a473cce4d316b854225b02ec61ed5492c54690758213858bee
SHA5124876544eba67cebbd31861b33db4f12ae0374a9a4a43ff91c1ff1502330f4cbc85c159850f47c6ee70d8fa5e93a0b6ccab3cb7ed047c9dc236e75e6534458faf
-
Filesize
6KB
MD5fc46ccf44eb269e76fb1ffbd3e7f07f0
SHA11d37a3964ee9c5f02a165e345ab4b408f1326e80
SHA2567733ee14f9ffb608234421bee634281cbf1a112332b89bdd45230f463c0cb7d2
SHA51229ca0f51510006a953283e0b22666e4e193f02c746933fa5d4312ad6f90904940e0bb920eadbe9de03d5c3a3df835daeb5722a5823b5108689349b06c7d23c12
-
Filesize
130KB
MD5f5bb8e91005d9a1e101d738d6a4396cc
SHA1f17e500609a3434b4eb1224257428dd06a526443
SHA2565846f15926a7bca2df04fc38ea03410e0a4a493d9cbc6970871d2db25888e891
SHA51265fc55aca74e674a71ea0aec63842e2940d611fc0ad0e00b802986c5ffb792bc1b8d7eb2ba70476f4744eaf654abdced1d952c9ad0ae034341e52c53e1fef6ef
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd