Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
50s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/04/2024, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
tminterface.html
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
tminterface.html
-
Size
76KB
-
MD5
17570632d49a667337f0346d43892a03
-
SHA1
60ace38f3ec3e8a3d68cc60c4ae64f9b42c0b78f
-
SHA256
838041e89a3a88177fd1bd27190e2c8448683c01416291602844e85f1737b27a
-
SHA512
f301d49c086a6a5aae93652dbf6020d2fac41472532cffecdc9d342d3dde8e6d856ba77289e91336c022103bdc1680396760ceb64e5a5b31e4772f0a49316305
-
SSDEEP
1536:C3PH70hz9+cQmPkghK+iAX75GTvfrVmPjAeNnxxY9IF1vGB8SiXs41Y2N/8MZDSc:hhRKX+Zg4W1C
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571675871076128" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 560 chrome.exe 560 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe Token: SeShutdownPrivilege 560 chrome.exe Token: SeCreatePagefilePrivilege 560 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe 560 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 4904 560 chrome.exe 78 PID 560 wrote to memory of 4904 560 chrome.exe 78 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 1628 560 chrome.exe 80 PID 560 wrote to memory of 2852 560 chrome.exe 81 PID 560 wrote to memory of 2852 560 chrome.exe 81 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82 PID 560 wrote to memory of 4464 560 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\tminterface.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa8a339758,0x7ffa8a339768,0x7ffa8a3397782⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:22⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:82⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:12⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:12⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:82⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5220 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:12⤵PID:4436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3176 --field-trial-handle=1808,i,4422722454264060933,8588552538791734468,131072 /prefetch:12⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5d6d89e3-da72-4c55-b667-305455c6707f.tmp
Filesize6KB
MD56577af9bb06691c305ef9785a01c7918
SHA1f3540874d22045e97eaa7b0c7e9ddc513c0796b4
SHA25653e6d2ef00b66bcf2eccdd09b611018e9a7c2015d2ea7f57a0e64d5907d2f7eb
SHA51268611ca132a861cf1160bd9d47397dd243fdea3a510b7cfe576a7f377be46029dfcdfe9ed30b8322612731a0f899af01213359d72436c34a8f08f52c7dfce0de
-
Filesize
706B
MD56b2c0e269d44138187a80635b437e8c3
SHA17d9e4c914d113d8186926616fcb28d517581895b
SHA256431acd61152488fb6ad00a0e56512390e70b7a8aa2d9e7a3e61d24ab4c4017de
SHA512570fd5abc42982bb120d940ddb95f4d7a95253d09a7c138809b4cd31611e23d2c7d93cd16ff7cce521bb6fa10daa63ebbce1f615a1cbb1ba8b30dc1492a25ebc
-
Filesize
6KB
MD5cc43d2f218adf12fb2c106d5e4fb100b
SHA12b2c52ef3f8c775f036728af871a527a771d36d2
SHA256cf515592a213284685b18fbd84552b74aaf4d5f50309f4fd7a523c0b393c4c3d
SHA5129e3913feede0a063d34cb3dfd63d49dd0f01e833da4fe59551530e8ac76a50e29b7b2fa5bfa580fa5c67237f31f3f48d82fefd5b859764025442bfc1189a8083
-
Filesize
130KB
MD57f22e3651ed3bd4dca4644a1a72c2cca
SHA13e2e21a095d4eb1c186278cd1a279d9d6d6f0bde
SHA2561b7378ec7d14eb42478a707c0965e90717ec6fbfb46f784b9efd7b5f92e6ce07
SHA512d6981bf85bb86160f471db9ed5f5c60df10c25263ddd34396266a4482ee6c898a6ea2d8e38c1bf68875a5cbbdc8170356e153e5a33ab1b54be3d56005e48ca94
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd