Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
21s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/06/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240426-en
windows11-21h2-x64
8 signatures
30 seconds
General
-
Target
sample.html
-
Size
156KB
-
MD5
05ede2b10efafe0d8979782daa8b1069
-
SHA1
a8af3830ff10e38afaf43f3ec6870c27b0517c15
-
SHA256
7c7f0ff369af92ba15d3b69310ed1a902417963e67f6491e71d752404424e397
-
SHA512
261582837d10aac6538508c86851caad03ababf05a3c79a977a6b55d58d3b41179acd7107d4383914814c66bbfeb159ca3e811bc19be93aae510080b9b0d6220
-
SSDEEP
768:ZHz09KOBYYLgLSIINAcfSPqj2fU2n2AQkJG1K9I22WYnNouzQFJ63SJKJFJbGrJT:ogLHiaN9IknFJ6obX
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622013849517511" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1484 chrome.exe 1484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1484 chrome.exe 1484 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe Token: SeShutdownPrivilege 1484 chrome.exe Token: SeCreatePagefilePrivilege 1484 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe 1484 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 4992 1484 chrome.exe 78 PID 1484 wrote to memory of 4992 1484 chrome.exe 78 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1920 1484 chrome.exe 79 PID 1484 wrote to memory of 1400 1484 chrome.exe 80 PID 1484 wrote to memory of 1400 1484 chrome.exe 80 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81 PID 1484 wrote to memory of 2644 1484 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1d5cab58,0x7ffa1d5cab68,0x7ffa1d5cab782⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:22⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:82⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2156 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:82⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:12⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:12⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:82⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1784,i,4170921306752824180,17841299262332022839,131072 /prefetch:82⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD548a4dcb7469dd4d22045337f27131f7e
SHA1bb9f7893924150e42dd6fc42d47a0f932a699380
SHA25676db6fa2b01fb01ac0520e4b983277101e306342403bc11a95fdee586acd3497
SHA512fc02dc4e8d99367c945f67bc1e0f3a7ae5c642e7e4decb0178cf8616f8382b5f9183acb5c5c8dd4a601c600307c14f96ccee6c931e56ff610161fe5e493591d0
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD58bd58af3cfe69599abc9b2756f22ef3f
SHA1e81eae8f58722d8f637eb2550e7aa0a4e408a196
SHA2568b73d31cbb315dfd88cd71fd6c4dcc15435372afc5902e04ea761ff661203d3d
SHA512424b924e40789b06fc559541b79a4f0acb358425ad6aa43d270a95cdb84976885b955469f1df081bce32f63d3d3d7d366e6934907c6439c416b47cb3a3b43b42
-
Filesize
7KB
MD5cf360c8c83b1a7a0a8f7e1eeae9d9f69
SHA17a15659d056a055458e22bacda61b4c4b1f6b167
SHA2567166200044f87a0b0b919db849edf9cfc8e56f4149a3ac53749b991e96bd95ef
SHA512d181227a5ee165cdc30cf7b9d70858f48bbd6525746a968fa61f32042e2c586e4832f1d9be2f6b573dc4baef562eb09861430a10370de2652273b9170f4fa984
-
Filesize
130KB
MD57f6bc0f79482ccd03e047b954d11c2b2
SHA18e64614416ffa63775641c1d66ffbef32994a5b9
SHA256886098e91fc69e6aa3108db958e92606c3ade7c7bbbcba655e6a9a5f69cc22db
SHA512a490eaebb13e16ad523a98cd67f7ab662fb51d57960dbd462ef30d9da7bda6a6bdce0a6752ba5c543fcca6b1b5d01f8ebe19acd070fb60ba22f29ee4ac3891da