Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/06/2024, 12:18
Behavioral task
behavioral1
Sample
7zxa.dll
Resource
win11-20240611-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
kailleraclient.dll
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
language/Spanish.dll
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
language/english.dll
Resource
win11-20240611-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
nestopia.exe
Resource
win11-20240508-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
readme.html
Resource
win11-20240611-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
unrar.dll
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
150 seconds
General
-
Target
readme.html
-
Size
35KB
-
MD5
66b83405551dd77e91c362ab29bdf36d
-
SHA1
08db7a053b9b3251c4575c534250134e55110fd9
-
SHA256
6da4f3714b64714b4be155c760879287cfb2b49edbe98fdfe30443c616bcb4de
-
SHA512
e009f40db9e1282ceab53d5a33f8566063ba8bd779ab026142f951d8daacde5c357d105a3767f7acd887a510017aa6b99ad9d844ba85d09284f7b6207b337ab6
-
SSDEEP
192:CGX9DuOjlVDwR92DQ2n+iomWyhby+urM0zIab6j14JSXyHzF0yR3NUxEw:C2vhVUX4Q2nNLg+GM0UA6j14CE0ydsEw
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630139810766959" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe Token: SeShutdownPrivilege 2316 chrome.exe Token: SeCreatePagefilePrivilege 2316 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe 2316 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1424 2316 chrome.exe 80 PID 2316 wrote to memory of 1424 2316 chrome.exe 80 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 1804 2316 chrome.exe 82 PID 2316 wrote to memory of 4424 2316 chrome.exe 83 PID 2316 wrote to memory of 4424 2316 chrome.exe 83 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84 PID 2316 wrote to memory of 1492 2316 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fd65ab58,0x7ff8fd65ab68,0x7ff8fd65ab782⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:22⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:82⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:12⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:82⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 --field-trial-handle=1816,i,5774718967528886847,7050441472123485859,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5ad8cb670c53f3facd4787e615d2f3ac0
SHA133f90ac3b11ac5ad7e6c4a742248128d0a101d2b
SHA25630be879e808a8473510eba2c87120d57d9351890167670f423204a49dd8f3aee
SHA51222684d2caa0ce93aba839cf2ebdd0a82aff5af2c467f3a66de66db8f740f86678c4c938907cae2fae9bae2a1e5fb46003fd14f1753b8eb88be153eed55bc0a21
-
Filesize
138KB
MD5dab0c591aa188070366d4f66ef846932
SHA192695e8cb758b745d72a81dfa5f4a488d1b59bdd
SHA256d5140c5f49f7232e15b7cb1c7768039510c216cd896427d5942d269c7d2bcd8e
SHA512c42fe9ddfaf852cb4e3ad4a3af3fe33b28afb2f2207dd9a87731ad95e418bead6699beeda4085ecdc263254e900e613d7e45d3ba891195496801895a585e86a3