Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
email-html-2.html
Resource
win10v2004-20240226-en
General
-
Target
email-html-2.html
-
Size
6KB
-
MD5
b735fe0e63efc5af0e149e82e14f893b
-
SHA1
686e326bcd008db68675fa5bbde870fc6d99f06e
-
SHA256
ba7b840b66aaa9126390dadaef7d401d02ea30b631eb2ba9cac2e0b752c87556
-
SHA512
ba98c38fbc79a70d38e56e00939144dce7f278a6aca0acd0ae59cd996e3d0ed306aff62d1fdbe8d3c5a7ffd9b2a95913351de94d311a81035b62b50487e4541e
-
SSDEEP
192:O+sBOesIB9fUULSNG0gKVND9qHwI5aHQBEDk:hEt2jp91vk
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133561145810413455" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5088 chrome.exe 5088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe Token: SeShutdownPrivilege 5104 chrome.exe Token: SeCreatePagefilePrivilege 5104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2248 5104 chrome.exe 86 PID 5104 wrote to memory of 2248 5104 chrome.exe 86 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 376 5104 chrome.exe 90 PID 5104 wrote to memory of 768 5104 chrome.exe 91 PID 5104 wrote to memory of 768 5104 chrome.exe 91 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92 PID 5104 wrote to memory of 3732 5104 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff842539758,0x7ff842539768,0x7ff8425397782⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:22⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:82⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:82⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:12⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:12⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:82⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5212 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:12⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 --field-trial-handle=1884,i,2121049831257476369,4514757126883935765,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360B
MD5daeb438ebbd4f59b280d35b94bd5fbff
SHA16390e641d8299ac4e4160027ed9211e1bd50478a
SHA256cd341c655b69fb0efa2330eba6a5d641d4420f09de44fb945acdaa486f7bd2f5
SHA5124652647b921021b5b21e4a20ec6ee0079d17abb2253a68150b99d2a66e85b6ab69f20ada0d82f269bbfaf95ef75990fdebb3fe490bec5f81f544fb5361c92ebb
-
Filesize
1KB
MD5a175c5c3afa82e97af3fe62620e56f95
SHA13295a4ae2a87d1ad0778a28e3f219acf1ce009bb
SHA25652d7f5b114a288734a7c439740bc9406527e9a746e388c5c03def93be8728ee1
SHA51273b27f3ab08f6d777d7fd93774da6129ec2bd3b25aa5603b1adde8cb35e63cd10da0d128acf8a6141588f5e1ef0ec20321ed0f18efad90368d81f8fe4874aa6f
-
Filesize
1KB
MD5986c0928b1f1fbaf9a3bea6544d73546
SHA1ed91ef2b2e2ecc709031bede9ae5826c8d4e1b37
SHA256dcfe8f0443d7856ba9e0b01ad228903a550c0593638b02e1fcd70974b8a800c4
SHA512912a4ddd10e78cdc9e0e33c35c88deb96f7db40dbac72426aee918de014242afe15f148c21c7ad856a1828fc9837bdf9fe086ed013a4cf606d1e5bcf41a557df
-
Filesize
1KB
MD5a861e2733c624be40a2a95a2affe020e
SHA10d3b1a15b1519d71d51d2861f783b16135f42753
SHA2560d56c006098d13b77e6270e2a7a613bf9e3c4264c34bc6c32e9f3b5162a8ddca
SHA5127e508dc5405e25b718a1466f874ccf1b416206907f4a40e315507d04ea8d52dd0f42d2c6024a4dd4af1cecf2eeaca4705ec45f5ad00bebf87e047be7b27ba9f5
-
Filesize
6KB
MD586b75632f3a27269f6537e0e8ac74fee
SHA10f099e24a0a9d31e7d3dd2f4fa2053f4bbf0b8d7
SHA256e42be953357d1857ed37312d8cd864ed44d5bf41d69c63f31136331148512150
SHA512562f4872ff3c45309c74a7476e628e03f5dc368b0ff2f8b6b686dd5af880a72dc226f19ee01ff7675324906fa4b68d16202e499a2a2ae8ec024892f44c0d2c5e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1c49647-b57f-41da-a6ce-3b7aaeb09305.tmp
Filesize6KB
MD5278632a15ab42bf23a5aa067bd6e3d4e
SHA1ba028ec2939dd1f3c4f170f2b6761fcd3253fa71
SHA256c8ce98042aa304bdf5c6e2c130d09bcd8abf96f921c1e6f2c5580c00ddfe3400
SHA5129f36f0dcb5ff6fb6eea7dfa00b6caf46a4a8110da8ad78ec5063afdd5107dc9d53d08a5e73cc2cc0122dc4916acd3816b87dac95bf54c7cb60bffce173afd2e9
-
Filesize
128KB
MD53ad62f36ef7b595f260304471b1b933c
SHA1cfcdb89da90fc7e7ba766db34f632765d2d61a84
SHA256210f0fceb1b819e101e31b61e00b3908be49fbc6b2486faf070e355d2e982dae
SHA512e9b999b06829219ecb122f176e52c1d7085b3690e0ecf89b4052ee80d8adfbdda3051d74932ce20a2a6cdb78b4529eb4f5f470c6ffdf759d43bb01baa8257008
-
Filesize
128KB
MD5b80b902f040fdde9013b60077b286583
SHA109a4c66bcb9af27a2a5645e2140dcb8b4cb9058e
SHA256096768a6801e65415fe166040b3a5696de688981a33c9eaf85ee781bb98d50ae
SHA512e147a90abaab89bc68c49c110eaaa853e6c07e17be943b7f0b107a63d2aaa0a411869aee28c7ea7e87d747740f31d2b6de7d9e7caa9fdcef3d41a0b914a00df1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd