Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/05/2024, 06:41
240517-hf19ysed23 6Analysis
-
max time kernel
299s -
max time network
245s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Juicio Martha Elene Pérez Shaar vs Sport City.eml
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
Juicio Martha Elene Pérez Shaar vs Sport City.eml
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
Demanda.pdf
Resource
win7-20240419-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
Demanda.pdf
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral5
Sample
email-html-2.html
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
email-plain-1.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
300 seconds
General
-
Target
email-html-2.html
-
Size
5KB
-
MD5
0c6b20cc9531d18724a866e4318350bf
-
SHA1
073cc7f5fb7babc7552021ebfab56aeb45768c05
-
SHA256
a38621fb81fd7878d3cb7939317acebc2ce36d20ecb2518938e775bf7920f09f
-
SHA512
654b2521feedf7789f750d3a34aa549ca67d0253fbb66587d895c1a064702c31fb406bc1b6a2dd26c54f0c376f63b0457fe30743e7fc8eadccb8253b62b26f44
-
SSDEEP
96:rq4tvSzjMnySzqERnrxsYtxfPR/pIi0Ndm49:XIQDVpfPROi0PF
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133604017341396740" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 4632 chrome.exe 4632 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2800 2760 chrome.exe 85 PID 2760 wrote to memory of 2800 2760 chrome.exe 85 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1940 2760 chrome.exe 86 PID 2760 wrote to memory of 1236 2760 chrome.exe 87 PID 2760 wrote to memory of 1236 2760 chrome.exe 87 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88 PID 2760 wrote to memory of 4636 2760 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1147ab58,0x7ffc1147ab68,0x7ffc1147ab782⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:22⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:82⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:12⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:12⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:82⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 --field-trial-handle=1884,i,16980809203424896439,18011937612159364637,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD579b48aefc2f6bef220d98fdced50ac13
SHA1b00ac1205777d266b7a652b070cde56e3997bcd7
SHA256ab4d8419c3d76ae07000e8235610b0cfb9fa57b7d7718d0bc9c2ec55e451b436
SHA5129656b428476e6a3a876c3fa25e5db3dc4bcca67a61cd55a22c0de72a40ba8e09ea1105187ca273d33a275a2095b78ce13f3139ddc0719404019bb08492d2665c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5284ec057e5e6ab5eae1a73da6acf4791
SHA13649741ed86863d51b3106dd5431484547c9ba8d
SHA2561fb056ab81c0e7249c4610d26f1a0d0e46dc14ab4b8cf45dbe2c05b49d837280
SHA5128aa59e11cf7d430bee09079d54e83df7028d1971551cc7f69cb7daba179a8c391b27cab660be569782640a533939f30d0ee56054c70e4944f151d005cde853e8
-
Filesize
130KB
MD5aee2a4661c9c07762405b005cddb3831
SHA168335b11615c498e5752e8d751eb7de61caf39b2
SHA2567ec4e99ead296a964e3a8286fb893a329891a9c76fffec401cd9ac6260b93afe
SHA51298bf8a1b72316888fb3510e3b92cc9dd9c8d76a6a68d4b6d8a6f4407129e27b4dba8934d3dde7a8aa49dc7624c4786616abae5c7f05b983db2133d49ae83d32f