Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
485s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/04/2024, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
roblox.html
Resource
win11-20240214-en
General
-
Target
roblox.html
-
Size
305KB
-
MD5
9b819cde3ab20b6087f24bf964126980
-
SHA1
7bda0d10c2dc3f4b25156f61b19a979a5b0064ff
-
SHA256
b55e73168f24e576588b38919e7a0a35f3b4a81dbbbb5000ad8418119b599462
-
SHA512
89384982e1db261c60d885b59a0cd998c5965cb1334237b115877dc7857ba44e618ddfaf393b0351d19c7427ec6cc007dde0295d932f13c770f740a294129753
-
SSDEEP
6144:LJyI9RQB8hoGw9C1P6F0P3JvWGfIlVxzvp:VRiDPFqJ4rp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133573191177580186" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 412 4916 chrome.exe 76 PID 4916 wrote to memory of 412 4916 chrome.exe 76 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4100 4916 chrome.exe 78 PID 4916 wrote to memory of 4656 4916 chrome.exe 79 PID 4916 wrote to memory of 4656 4916 chrome.exe 79 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80 PID 4916 wrote to memory of 2412 4916 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\roblox.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc032c9758,0x7ffc032c9768,0x7ffc032c97782⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:22⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:82⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:12⤵PID:668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:12⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:82⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:82⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3924 --field-trial-handle=1844,i,15276132340784441558,17823859514676150198,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e711a84601f13a4bbbf91fccdf43b373
SHA1e1960b31f7fb542dfdc08619e0c67b40e884c691
SHA2562c759003c1f30f384c11773674bd6d0f3c0f544216a5327d01ccd3608862002a
SHA512bb800759daaa0b4dd3d6fd1cfc8115df76d1271c15c25b87e7eb4e73178b1632e8eb8eea245e00e147383d0e05dc14d506c84e6698cbb33c799d3b7ce917cdfd
-
Filesize
706B
MD5cea236e8f5ae0f039e08145d60b70919
SHA13f8faf34a920f4437724da701aa49d79a46d9d0c
SHA256e663751abec4b1588addc8853759b011f896af0aa7928dd790c2e5b9a44458be
SHA512a3747bd778780ed045e0498a759ef0d65d525808bb48137a1547bee54644f18b2d37bab7cc808e2d5804ab623a7975130197ed8b51ecf9d3d9958380ffc12adc
-
Filesize
6KB
MD5d9aa88bdad891071b20c125518d178a4
SHA126f424eb14dbb9a7ce88c8e4e93cbe4ee0498701
SHA25641dea5607b680168504dfcb35fc495e6b592c2d42bb7d0b38f1fc1c7e6cf7af0
SHA5125f71c1a8bf4a374158d934a80535a6e9905329e31f66a8927a3c12558895b549835297f7b4422b5f849077ad40c67fe0567b4dcdfb0e74cc90dbeb097fafe94c
-
Filesize
6KB
MD5b694a2b2184459e95e1095a86072d3e1
SHA12d2b8baf21a1d04a24caa7e8bfa56626014c70fb
SHA2567236bad03ecd87fc96a15b8b69250593e3794727e6aec5c8b02eb31239efe9ec
SHA512f41573420f60afcf36b5058bf7e8ddb6ae191aa176157e59f91160f401150a5fb62b05d5e8d5c405bfda70f0b74b405c33e815d907782849a1f8fd5b67429b30
-
Filesize
129KB
MD5d67c6f76b03f64166b30bd0c6358ff63
SHA1142aeb05f87b722a189b3f56ccb3d6b02c9a6818
SHA2561e06a5bf741953ecd6f1c9a6ae41d2a8539d5a97ae19321d503c5524a64f23f5
SHA51254854863875763eb544f764379826c602ecf5de79981158e282995a6ddfe6c29b5243509720d141e968ed94f8f574f5e43fa89943d096b246f6607b4f950776a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd