Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/04/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
1800 seconds
General
-
Target
sample.html
-
Size
18KB
-
MD5
3006df5212aedebd8dc6d1059051c179
-
SHA1
6cafa67cf127e8e5740a2e5a96f33da86af9e177
-
SHA256
b349773c25788a8ed3c030166c05ddf71402d413f4328a5ba8272c94e3eda631
-
SHA512
28479f043dcf906026b20b51cd3dae7e97665cc32d04f4de5cd4aee844ca7e6cd07ccd9695f240ef8f2965fd9e557507fd1cda9fe45dc3e52ab00b17b4c2dbdc
-
SSDEEP
384:rpQUDpmReVoOs4YN9ylKeGMFU8HhhbhXM7BS2LjFrSF+eXVJCBXQL:rOUBVoOs4YryI1MJBhbJ6pFrSBJQQL
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580210876454568" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 824 chrome.exe 824 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 824 chrome.exe 824 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeCreatePagefilePrivilege 824 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 824 wrote to memory of 4384 824 chrome.exe 73 PID 824 wrote to memory of 4384 824 chrome.exe 73 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 1140 824 chrome.exe 75 PID 824 wrote to memory of 2168 824 chrome.exe 76 PID 824 wrote to memory of 2168 824 chrome.exe 76 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77 PID 824 wrote to memory of 5112 824 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffca65a9758,0x7ffca65a9768,0x7ffca65a97782⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:22⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:12⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:82⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2488 --field-trial-handle=1716,i,8497477499574082185,10593446531705287950,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ae64a94b64b4835aa02b46b7265061fa
SHA1b3051d5035b0d03ef061ac85ea3d4fd734254464
SHA256c3d7410a6ea1ae8c72f151ffefb43ca84e44ec5db23868b1e4bcb806173c212d
SHA51272d57e3e87d0a58de3d5be73d45efd3eb3965c1817fd81e56100c76261e6455c8b7c364e4e4f5bd697beb3c680e5c565080b5f81596914d29a1db0ddc848e74c
-
Filesize
5KB
MD515f2c9935634dc1fca142b3cd195c1dc
SHA118af412c93534fa855c61f9c121971af6e0c8ed2
SHA25623e4b53f6dafb3bba2ae038c3614c6d42f484f64cf9ea67f3e844225de0b5838
SHA512131cef0865e62283583e09909ced82ad4d783a6c1dc1a70ee8daebbcda3e61318409036b8e7b90ab1862af6bac8e9e8b8ede154b98b50289ff00501992c61487
-
Filesize
5KB
MD5dc940c6e587ae1f29030db571b719f2e
SHA1d19e6d5d52c8188a69214d1d231ad81b030bfc1f
SHA256fda2b86bc954e980fe323404c00ee737955cfb2b9e9c344be533da8d5d85c414
SHA51232170297d1d1fbe693f52ff983cfd0d3b37adb147b3db735165ffc23ce9507056e7c73077a0ad24d81d468eab38fadc8807a85c97c30e08b41b103ad74ddef17
-
Filesize
136KB
MD531dc462f4290ade617dc445a5cde95bd
SHA1585e80a30acdff1c09f0c22225a8ee4cc141e0e8
SHA256075d923d66f6eb0b6420813835d2f66a41c3dfecf22ebe63ce0dd29e191aeef6
SHA5125b10027c2d087561eb3c9de76c9e51176cdb9737c5fd5aa77c48b1b962c361c4b0075613cd06041fdd6e423d1ae0a0f3dcde41e53597ca3cd731559bad4366c9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd