Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
53s -
platform
windows10-1703_x64 -
resource
win10-20240404-de -
resource tags
arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
20/09/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10-20240404-de
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-de
General
-
Target
sample.html
-
Size
549KB
-
MD5
1fa8a9e376d736ef0af07027460884b5
-
SHA1
c41a15984551509f11a8c6cc8d9dcf10fbbfee0b
-
SHA256
5d08cc4e26e02a997152d1926ab916133a08c6f331cebe1835578261653966b7
-
SHA512
3a9fbfb7d3194623c40e2d5eac7f6f59f14a36d224c40f97409f253109916e5e3f73d46b18a8d16193d3733b72876b73ea9ef3ab6ff80dd8c417a9095fd1e3a9
-
SSDEEP
1536:VqsK64sZIQZoQI4o+I/eI4phImPojHfhjDlI4KkIJwrI4MaIz3I4ysIB0I40CIre:VKjHfhjDlijeLEmL1k3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713438525084661" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2280 chrome.exe 2280 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe Token: SeShutdownPrivilege 2280 chrome.exe Token: SeCreatePagefilePrivilege 2280 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe 2280 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 196 2280 chrome.exe 74 PID 2280 wrote to memory of 196 2280 chrome.exe 74 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 3736 2280 chrome.exe 76 PID 2280 wrote to memory of 4124 2280 chrome.exe 77 PID 2280 wrote to memory of 4124 2280 chrome.exe 77 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78 PID 2280 wrote to memory of 4612 2280 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffab9a09758,0x7ffab9a09768,0x7ffab9a097782⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:22⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:12⤵PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:12⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:12⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3956 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:12⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2960 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2972 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:82⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3588 --field-trial-handle=1800,i,8628875911456073933,15522695883161567617,131072 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD51f3593105024a4aecd4760dcaa6d1dbe
SHA1d609ec8f3d10c856355563ed767e0339e931c370
SHA256964243e073edd5deddd9f34ddb7778f34d986bafedb89a40b8606891deb44130
SHA512cbf06cacc3fe925c6955f36ab817924dc96bb3b81188f24ce5025907047e94a6667ba7fe75e1a6744bc7b659e4d201b8a7aa68ff869bdb93e630750bc2a008c2
-
Filesize
6KB
MD59c7f210e90bce399cadf4050355b8850
SHA1c922e1a2395ed4ca9632e94733dffe43977896fc
SHA256f2c8a760c2f81595796361d238b5ab5aba20ad6c13d6536490a1ec823e473d21
SHA51211e05efebbecdcd09cbfa885b6cd866e7740f3ab8de7a3d64fffe58bb200842e445335d34d226c79c9d812009902169beb24f75ebde24f867c1d7dc24b8edc77
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b05a57e0-2f51-4c65-a528-d64e0b2b33b0.tmp
Filesize6KB
MD5fb49ae80113f4c1e024fd1be3300a67b
SHA12f84dfc85af4ec5c4cef747ee693114ae4e8f001
SHA2568eca6714bbd8eb4a71a5794687d748b8b4fb52d00fbc9a5d33354f3bd1eaab2f
SHA5128a7214d6aad123541817262dd71d7b39eb1cff2ab5c17943656b2ab3dd67fa6689f422d3008214f1117c217e3862d4b5dd4f9d4fd727d61071ade7ec97e31311
-
Filesize
137KB
MD5b564d25406c06b07cc0309ead8c27d64
SHA1c32dbb1bcb7dde4d33b5289717156045314f9abb
SHA256add67b748b33f4094925eff73654c74c44def6c612f3ca70032ac883cc5a539e
SHA512db6281c823aa1904e30f3d8b445eaff0635d852894ecdefa9ca9ecea85c2205c0e356e83bcb311f35883bf2d6c64f84af3df4ab010a793b491d2b7e8446e5bbd
-
Filesize
138KB
MD5bb92535a1a332790a10b4b3f53d867eb
SHA1f24b9a79b5bf983ab24ae167b96b37d570f90982
SHA256b7f2f5463908335061bd7cd2c87089ee4cd8c9592ba162c99faf0a150f24a374
SHA51279cff6b45dcbc1faa4bcedc102843a05a42bee63876d978e743fb3fb5ee98ed3bc5265d613dba4667b5ceddad921ac7085170655d508976d2ede4d1dce2a18fa
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd