Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
108s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/06/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
Bid Proposal.html
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
300 seconds
General
-
Target
Bid Proposal.html
-
Size
662B
-
MD5
dc578e20aeaaa1529197bf59a43c5b2f
-
SHA1
be2e3ea9d256bbfa2ccbd7e15ee9acdc8d6a546a
-
SHA256
3f96141c20a4d312aa34dc917dc6020499e2cb5db25fc5bf3e2d1025fceab64d
-
SHA512
58f2bd1e118fcd0b10d22219618e51bcf1097bb19a310ebddd0e76470f7974ece932469427f81c83c064d9486463b1a121e5176082635fe27579087b851149bb
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640782631595509" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2708 chrome.exe 2708 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe Token: SeShutdownPrivilege 2708 chrome.exe Token: SeCreatePagefilePrivilege 2708 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe 2708 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 5052 2708 chrome.exe 77 PID 2708 wrote to memory of 5052 2708 chrome.exe 77 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 4336 2708 chrome.exe 78 PID 2708 wrote to memory of 1108 2708 chrome.exe 79 PID 2708 wrote to memory of 1108 2708 chrome.exe 79 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80 PID 2708 wrote to memory of 2040 2708 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Bid Proposal.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff72ffab58,0x7fff72ffab68,0x7fff72ffab782⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:22⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:82⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2104 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:82⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:12⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4024 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:12⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1792,i,3404330112725792440,4756440447989160164,131072 /prefetch:82⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
929B
MD5878e45fce997391532861babfa715765
SHA1fe9d8c8d58abf8e6c7bdd46a2578ddb7773ff97d
SHA2564a96854e801e198b2c34839463baf465cb3c24fc2fc6beb1f22d16037d2014be
SHA5122817facb99d35e1bfbd4e1a2e60091acf8d0032a048ca0bec9159a79f7263eb8906d234e2fd9eaf546e71c6f81c30cc1bc6f7df09af52924aa81150c8c642f96
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD517c09aa067e00bcdfc915afcbd402fa7
SHA1ca4f05949b29370fdf86c68818b709804d104da7
SHA2567e848d2604799d74d799782741e511f6f189523c1b1f4f95777d6c5a6adf6c58
SHA5128014ee6995d09ec1c24d7eaca679557b56419782404b17dad81f4a4288c5e34dc58f0513294ca9cb019d8b6056923cae7867f38305ccb207eac862d1af0c8b31
-
Filesize
129KB
MD5af0ed538d6d394c608abb6830309c867
SHA12e2fe5af9e5af10b3c40ee17973a962d95755245
SHA25674709d82b67daaedd3a97df71d4a8281d059aeb6b3dc441ba9cfc86fbb3828e1
SHA512581a4b5cac91681bf0bd6079c33afabdbdc89b22df72c29e96c01d3206c72b5fbf17a300b841668457b51542f5c65be37024c83ff9a1c1550e29ae5de4eb7aeb