Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/06/2024, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240426-en
General
-
Target
sample.html
-
Size
42KB
-
MD5
c994fc81480fd52e51f9c894e60271a8
-
SHA1
f620ef2c0d4f5490169c5123ecb97199c739a2d0
-
SHA256
50b88d6803d21e799b597495cb3f17f29545b921ed8a52b0b3490a04ff65d9d0
-
SHA512
c97a62b7ebd3defde5581ca366923f8f7b87ead2c0f4a8bb4f8d60fb94c729f5ad3772431688ec816206a9dbeccce168ae6cb102494ee90e02d480807504599c
-
SSDEEP
768:fnBOOCBw/Fq/uQAJS2h8PfbJk4xyi3ceqhnRLPknOhqt:lJDh8PfbJkviN8cnOct
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619231100324994" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 5016 chrome.exe 5016 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe Token: SeShutdownPrivilege 4340 chrome.exe Token: SeCreatePagefilePrivilege 4340 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe 4340 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 8 4340 chrome.exe 77 PID 4340 wrote to memory of 8 4340 chrome.exe 77 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 4052 4340 chrome.exe 78 PID 4340 wrote to memory of 2336 4340 chrome.exe 79 PID 4340 wrote to memory of 2336 4340 chrome.exe 79 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80 PID 4340 wrote to memory of 4488 4340 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb06f9ab58,0x7ffb06f9ab68,0x7ffb06f9ab782⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:22⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1504 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:82⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4140 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:12⤵PID:944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3844 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3852 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:12⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:82⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:82⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 --field-trial-handle=1832,i,12106862717835158754,7070821279881155761,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD5b77c7779b6632ce100af60c87f7dac0d
SHA1b6a47e19c5af71504041f165dd6e63b0c662846d
SHA256a4b10d3094cdae99a592435f2322066d5167f0c06fb635495ea00d0d481d8291
SHA5128690de774fd3431492b88b6353d5878a61dab767c65455592e42d409b569ca2d285266b7b3023babe678e3b4fd94f54b47794d58d7dc5220b2a1817a71c6c86b
-
Filesize
1KB
MD57ad7eb2e698b0229747d214a3b0f3dab
SHA1b1aab7ccc0475b8d3b6997aed14c29e882d84dc7
SHA2560bd86e8a570450e4a0cdffbd3f3487795f6d95e3d3c8f23e77477e597b7860d1
SHA5129f1db5aebd00cff62cc72c221e86788687552dbda431b8784458b7c254f2a4104f8fb42150556c9e813a26d355d703ab0a272dd4b5f6af05ea1b360cfcd5a552
-
Filesize
2KB
MD5db2b220a07c81657e86f70dac4bbb707
SHA1da08670c8b5fa7df4a006c2ba302c780ff624fac
SHA25609059ff84880919bc117caf39b31177c76e499ad9c149bd9349635ab7bb041be
SHA512965f949b78f32b1248d9ecd540bf98cbb3b4fbe188640948ed89bee4bcd2d9f61eed96191f97f79528155f876eb3f6a90327e37e7b8710885a7ef5a983f90c48
-
Filesize
2KB
MD5586b5afa7845629a623c342072c698f0
SHA18ed5c6fea23684b8bae32264d4a8a22ef0776841
SHA256bbbea6911480394eb1efc9c0e99dd80dd1f3cdaa9d94bce9d973d0f6612bbd03
SHA512c1d148bf0d13a5f60e1d6be3ed4e65c27b2f081e400cbd9952ab201bcb29985e24f28a6b77b423851f5085c5dc92e586f9e1f96df9c650adba39f8ed7924da05
-
Filesize
2KB
MD58d540d89ce9015785b3124ad2b92822e
SHA121cb4001983c52d070802335c3ccbb34ea29c82d
SHA2569b7778cf2af4827a5e99909683496ab76b9ab7f6cbab68f634ad2743d23c403f
SHA512646196b4b02c3cdb27ad3acb1886566496f2e2c83330015e11437e1d6a2cee00229a8bd7ffbfd5977428d29126045f03501a46a9b9bf22a180f5b2ce8480aba8
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD579e84c428337f71165dfa10d16f3bc78
SHA1f758e5014bd73c182e309a4afcaa9e3ed08bbc44
SHA25602271e511b6af40259ffcf4f0278822aae21710a55c32f08fafd9a37d95da86b
SHA51247a4e4ea02d518968088b7958d9b729e1e8a51bbcae640e93f46d7b67a3505b0c12ce499858fdb313b293c46376f1c96c17371d7938979b5cf9d08797a444d5c
-
Filesize
7KB
MD57e7ce4fcfd419794fb234fd4b4f3001f
SHA133064b3dba4a4ae7feb35121b6285aa4c7c9761f
SHA256f1d7b0a1f1228a299e78c2225496065d98cb64a39b1909bc4c17d3c5bace5d76
SHA51255ce8e459f353986c09d469990440d3ac9a0bdae5a459d35edf457eed1635bdf7d13fbb79ebd0290b6193eb07577ee2f13ff9bb5724fa1ca125c78d3b4bf6e45
-
Filesize
130KB
MD5816fb3b403e563e4ef7ba5c550f0c3ff
SHA1faea3439d4894d79e457b8182ded48429dd15759
SHA25600acf40fc73419b74d0e23d3ad024cb77739d1f5bf48fffc0e056afecb8fcffa
SHA512379ddc61f71c1f269ab07da1e54bc6bf2c6862216c11f07268a8e252528de536d9c03ffb52ad9362592d93cf3e44a5fac5d525fa2c2b67dd6be695b26ba21b32