Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-de -
resource tags
arch:x64arch:x86image:win10v2004-20240802-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
20/09/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10-20240404-de
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-de
General
-
Target
sample.html
-
Size
549KB
-
MD5
1fa8a9e376d736ef0af07027460884b5
-
SHA1
c41a15984551509f11a8c6cc8d9dcf10fbbfee0b
-
SHA256
5d08cc4e26e02a997152d1926ab916133a08c6f331cebe1835578261653966b7
-
SHA512
3a9fbfb7d3194623c40e2d5eac7f6f59f14a36d224c40f97409f253109916e5e3f73d46b18a8d16193d3733b72876b73ea9ef3ab6ff80dd8c417a9095fd1e3a9
-
SSDEEP
1536:VqsK64sZIQZoQI4o+I/eI4phImPojHfhjDlI4KkIJwrI4MaIz3I4ysIB0I40CIre:VKjHfhjDlijeLEmL1k3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713438525369648" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1116 chrome.exe 1116 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe Token: SeShutdownPrivilege 1116 chrome.exe Token: SeCreatePagefilePrivilege 1116 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe 1116 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 3316 1116 chrome.exe 82 PID 1116 wrote to memory of 3316 1116 chrome.exe 82 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 3892 1116 chrome.exe 83 PID 1116 wrote to memory of 1496 1116 chrome.exe 84 PID 1116 wrote to memory of 1496 1116 chrome.exe 84 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85 PID 1116 wrote to memory of 4768 1116 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff88ebdcc40,0x7ff88ebdcc4c,0x7ff88ebdcc582⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:32⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2400 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4480 /prefetch:12⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4008,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4004 /prefetch:12⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4092,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:82⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3392,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD546db77753823f9e0d8e08b455f2aafcf
SHA182c94d66714b9bfbd6c222f082ed268de10912c5
SHA256e792fd81663bdb20b62283564e7836ab3ddd1da3ed926f3536245b4132859a21
SHA5127ca5f8b1f4495438812bcc5650ec75cb22db5a52dc6f7035c79755a47ae9cbb3c0e6d85d000753d74ab57a8d0bc6314366d8fff07352c036e12da44343df9efb
-
Filesize
1KB
MD5ef8e029489a8a17b4dece70e82a37581
SHA1d7a9129f59b840d8844f6df8467c00cc85164f54
SHA2562f78ce0a14c5786c252bed5ee11cf0fe6e1b4bbb0c76e4965bedb64ac31df45e
SHA51227b3cc00f35f1966971b0008905f8356dc532d5ee8d69618ca152155fd4d23d2cbd3372a951ab2cef3fc48f934696cb74b026321f694d495c74b7571a99c06bb
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5981afaa9f17671e29b806fd494440f39
SHA19679b5f990ebb62745512db13239bdaf54af5266
SHA256c4358a9d0f8faa5f1bf94f795137b895fa874ccd4b3b8e7c83bf6649208fc4c8
SHA51290e1fa0e162e5a9ea0f6291aece2f1541caa177ce3e393f60c11ccb2dc52ab99edb19dd600cc031014056398de4dd2485a2568f19b16131b3f94a28ec09c9824
-
Filesize
9KB
MD5abcdb107b71f2a3d1af2775fb809b259
SHA10a7af2e23e224f2042e00a7b32b64b72336749a6
SHA256f2d5df9179ed022173b2143440def7a01e45294239b2f76714f111b56486366d
SHA512dcb75bd6c4844c383096b5e3601c1c5575b207e91d08847036a7928fc1ebd2fc2a06ac68ad40d82ce95dab700dbbab52e57522ddec8d2c6f4708746a0bf3faca
-
Filesize
10KB
MD54e3ee2137077e0092ea361b7f0b2cc26
SHA1621916e474137152e6e30b9e8ee36be6f3cf2860
SHA256b210a7c7f308e1dee7c2fb11cb7d548942b38b855992a3af7106a1a6ba9a5a06
SHA51243b12a3adf81d903b45c20b2f752e24d7c36cdde4716d0f2e2d5e81e7b7806399f7add683eacc88d091ee24bf7fee66e59cb768126a0befc2bde546abb1d14bf
-
Filesize
99KB
MD5458e89a44a5ac2f6215f5035bdbb2594
SHA1ee05ae1c519dd9ed7a3afe2377a5c81440d9deaa
SHA25652e950303703306c6e60f1d5003c59e4901536a7c054e0615da7db0f8b0792f2
SHA512e32c08c4216dfaceef366038519d006e91a12ee1b117dd8a335062eeff811de578c1ae81178ee0a52d0dd73dc147c029560959794880e06ec7305fddf555547c
-
Filesize
99KB
MD5d58fb5de273f7f378fdba0099b9d5e0b
SHA1c98c5668a6a8505be4664cd4c0199b49eb492463
SHA256862e20d62aca42a029322a82d68d18f0d2d068d6b7658a50c8d08a9f55ac493f
SHA512de8ed2ed30c7907547cc75807bbf08e77041d168dc024f3370c3553e88aaae98f6b894fda1d8aeb34800d6a2f32726f13fb8c23ce0118b8e753e8676d04e1306
-
Filesize
264KB
MD554284ff051fe8c4b6f4e24258ff81675
SHA1ee1e20d0136ca3f6c6e8740b3cf77a05d90257c7
SHA2560ba90723af0cf1055545acd0873aa3f63f5d283a3320bc9d0229668f8c8bc4a0
SHA512a4ef897edbdbf88d40097b3e555986b8e30c9dafff5dff527acea71c514e6ed47878e37e12fafeb28f571d10011e55ff3a7b18941aa1a95ad6dbb4aa892a0bd6