Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1686s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/03/2024, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
1800 seconds
General
-
Target
sample.html
-
Size
15KB
-
MD5
65cb7e02cea46de928836a8d4ac8959d
-
SHA1
c465fee453b3700f1c3d362866887ae7c025492e
-
SHA256
bea9521aa546912b5a684b51ab835afa44d718ca60212c60f93f23ec7f8a3cb9
-
SHA512
74b9588dc59fb7d10b9dc35a3124fbdd8e40fc29d65ef3c431ea81910a576c7c7a303d67e3406e153a72ebbfff5c56e6ee1a48a8be5250fabff02d7534cfcd4b
-
SSDEEP
384:x6j9HlAALRcomwFfNmBSZv5HvvQ1TCxzbEMhHPIKlkT2zp59FqJPku7:6SuxEDkC
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549030286624597" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 4576 1064 chrome.exe 80 PID 1064 wrote to memory of 4576 1064 chrome.exe 80 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 2880 1064 chrome.exe 83 PID 1064 wrote to memory of 796 1064 chrome.exe 84 PID 1064 wrote to memory of 796 1064 chrome.exe 84 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85 PID 1064 wrote to memory of 2032 1064 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa51f99758,0x7ffa51f99768,0x7ffa51f997782⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:22⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:82⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:82⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:82⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 --field-trial-handle=1816,i,15896926107731681300,6539456405643988678,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51b51b4a727937956d38f39e335b4d938
SHA1a0565120c98bae809ec25443fbfb848634c100cd
SHA25662a4855d2aa48b1cfa58217dde19e7ea257b02a7fe077eb3b89ca5a06114568e
SHA51237beaf72ce6abf3889c45658d8cef89f62db3d29a80d088e6d1b65c55c5372264a8b29e011d2a07397fd4c671bd0881aa0bf35ab9ad625d9713494fb5903daf5
-
Filesize
6KB
MD5cbfe2641ce42697180e3530db46be46b
SHA1365994c81dce0e783eb384f77efa48e98a5e6a61
SHA2562dae90b60df5abe5d97661be842eb7ee8289008737fc56da07d422ee94063df1
SHA51223fd8b138974644f8435ea3d397074da65f3cf963ea2a17cf27ee99235ddf6b948396543a741c9362694611d9806f72104d33ddfa32ab0216db10eb801e0ba1f
-
Filesize
6KB
MD5c4369ac960ac18255245f7fb1400ef9b
SHA1ed7b38f9412782b15ff712182420e99d2dfa463b
SHA256b1673431c75e8b71ed1affb7cd2c79c123d8842b39158b78bf65faad69314c73
SHA512ebc33e8f0506dd45e492febbb5ef7e3952eed6c47e5f236e2bb3dd8a30891d164a28bc819606af7888559cf38137226c5fe8fb42e0e046cc92a372192bd094da
-
Filesize
130KB
MD5dbfc12a34a2aa02d418cc2a597e57211
SHA14660147ebe62065be6ef57f5b41eaa8855f6432f
SHA2560968d25be0b810d3254a3c0eecd145d54e00e762e78e3f12a84c3a0fbb0d0e5d
SHA51272c098e98b77d254da6437c68b7d95034236e7fd5e66071f08381f1875112dabae63c5005b485ed17239d22b75e207bafa21ffc0f5770c9b354f51218a7b127c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd