Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe
Resource
win10v2004-20220812-en
General
-
Target
3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe
-
Size
72KB
-
MD5
f44e19bdfb48d55070b178f2390cb377
-
SHA1
51a80565642350107b469896f983b2b65eb08864
-
SHA256
3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053
-
SHA512
a7f6c2cd37800248d70a74882fbbc39c59c822c70f44bd9c61e1fe6590ff57ab6c8a84403b4c0ae580c1048fa9f31094c7d6e443bd377f55e3a680f58f9fe01f
-
SSDEEP
768:1gR2+xq206IEcCv69Xt/OGf2nLtyXUNA0ev0Z:1gR2+x/OEPv63xOnLAcAXvG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\23228385-afa9-4f30-b4b4-4752a179a8a0.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220919030828.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4128 msedge.exe 4128 msedge.exe 4988 identity_helper.exe 4988 identity_helper.exe 2576 msedge.exe 2576 msedge.exe 2576 msedge.exe 2576 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4128 msedge.exe 4128 msedge.exe 4128 msedge.exe 4128 msedge.exe 4128 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4128 msedge.exe 4128 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4976 3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 1648 4976 3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe 82 PID 4976 wrote to memory of 1648 4976 3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe 82 PID 4976 wrote to memory of 1648 4976 3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe 82 PID 4896 wrote to memory of 4128 4896 explorer.exe 84 PID 4896 wrote to memory of 4128 4896 explorer.exe 84 PID 4128 wrote to memory of 320 4128 msedge.exe 87 PID 4128 wrote to memory of 320 4128 msedge.exe 87 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 3256 4128 msedge.exe 92 PID 4128 wrote to memory of 4652 4128 msedge.exe 93 PID 4128 wrote to memory of 4652 4128 msedge.exe 93 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95 PID 4128 wrote to memory of 844 4128 msedge.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe"C:\Users\Admin\AppData\Local\Temp\3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\explorer.exeexplorer http://hi.baidu.com/qq289555239/blog2⤵PID:1648
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hi.baidu.com/qq289555239/blog2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab72146f8,0x7ffab7214708,0x7ffab72147183⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:83⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 /prefetch:83⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:13⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5800 /prefetch:83⤵PID:204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:13⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:13⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:83⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4224 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff791a65460,0x7ff791a65470,0x7ff791a654804⤵PID:4884
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:83⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5296 /prefetch:83⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:83⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5284 /prefetch:83⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1044 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,10147446992989799159,11596094714520939691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1260 /prefetch:83⤵PID:2252
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4344