Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/05/2024, 04:29
240522-e39m3aca78 1011/05/2024, 11:09
240511-m9hrxsge69 1011/05/2024, 10:59
240511-m3ndtsdd2y 109/05/2024, 13:02
240509-p91nvaag8v 1004/05/2024, 06:42
240504-hgj23ahe67 102/05/2024, 14:21
240502-rpcsdscg77 10Analysis
-
max time kernel
222s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 10:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download.tt2dd.com/
Resource
win7-20231129-en
windows7-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
https://download.tt2dd.com/
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
600 seconds
Behavioral task
behavioral3
Sample
https://download.tt2dd.com/
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral4
Sample
https://download.tt2dd.com/
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
600 seconds
General
-
Target
https://download.tt2dd.com/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598990010802547" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe Token: SeShutdownPrivilege 1144 chrome.exe Token: SeCreatePagefilePrivilege 1144 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe 1144 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1204 1144 chrome.exe 82 PID 1144 wrote to memory of 1204 1144 chrome.exe 82 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 2372 1144 chrome.exe 84 PID 1144 wrote to memory of 396 1144 chrome.exe 85 PID 1144 wrote to memory of 396 1144 chrome.exe 85 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86 PID 1144 wrote to memory of 5108 1144 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download.tt2dd.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc001fab58,0x7ffc001fab68,0x7ffc001fab782⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:22⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:82⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:12⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:82⤵PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1856,i,18327352852931571652,3188693796669516248,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD500c439027db4e17399fad36211aece2e
SHA1e94e5afe09071c02860a99ae5089b832f4249cc4
SHA256d1273b9ac1854cf080dffa3671dd773f8be7f45ffc863571eb1b68af30b337b3
SHA512eb855e548d01d3098ddcfd738f73b4a689f4c491a4f52ac1f3df0bea7f9b21f4e806776bb0511ba231f1d8a876e86c9eebd358ef95302e342d4bc8755280aef4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD5d85ec4654d7f38cbfd14af7cb7f49b1c
SHA1aaacd0b3ffcee73fe0fc87da3189a55788eed42d
SHA256c0cc1681fba3f7d4ac6222bf19db0c3d361f8ef804c772890e418dfac28c5c97
SHA512986e1b40caf5e7f2fb84ebe00e51c08b3f33721c39e6827a3e7d5236a6a0312d13ff52525fc0f8913dd33fe40c0e37c7ac5771abf797d1f9cca1d48d5cc67753
-
Filesize
7KB
MD57d35e89dfd7c5703b1b99c1101ccf7a7
SHA1ea313577976b5ec5edde547d45478c4331b80467
SHA256a331d2e457d25ef062d737086abff03d4edcebfd66729122ccbb95c43086e5b3
SHA5124ebce7ad5d1944a07f61fc62446f606596575cfebbb3f64761e184206f0c04a714da81c607ac81fc8d1e1489f7593a8c074f8a0bceb38772bccdab7a142663d3
-
Filesize
255KB
MD52dec0f0bc95ed9cd85b08e4b9e804208
SHA189abfecb7a07fc4e6f6fab72da67749a4c9113b8
SHA2567f6507791743c9c2f8a162bd23a065bae2e98dab5a42361c278224abba28ed06
SHA5128b48d8ac58d57091afa0f9bb6b68e786a92a93b2e02e9f9b25645666ccd24ed1512cbc150364ff577139cb2fbce39d31f2b59e6af2d4c0877e2fb02d15bedb9f