Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2022, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe
Resource
win10v2004-20220812-en
General
-
Target
3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe
-
Size
257KB
-
MD5
fb603a1a23eb7fcc9794f6e0134556dc
-
SHA1
add153e8faa4f12bb4c512eeddef5858e4187a52
-
SHA256
3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730
-
SHA512
411124d08efc7d4d118be0e7fd0898d9070a3be27c742b7f7f0e9ea05e0ed705efaf9e5eaa303e9a487ecc1f34f1975d23c726418854100e298090fbaa803cf6
-
SSDEEP
192:gcM56SRqV4l8Q7jUq+OLIJU9pjqAHwMdnyp:gPRy46Q7gq+o6U98M0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b67a4951-968e-4081-8bb3-4df6023e491d.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221015054313.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4196 msedge.exe 4196 msedge.exe 612 identity_helper.exe 612 identity_helper.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4196 msedge.exe 4196 msedge.exe 4196 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 812 wrote to memory of 4196 812 3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe 86 PID 812 wrote to memory of 4196 812 3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe 86 PID 4196 wrote to memory of 3664 4196 msedge.exe 87 PID 4196 wrote to memory of 3664 4196 msedge.exe 87 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 2016 4196 msedge.exe 90 PID 4196 wrote to memory of 4000 4196 msedge.exe 91 PID 4196 wrote to memory of 4000 4196 msedge.exe 91 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92 PID 4196 wrote to memory of 1776 4196 msedge.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe"C:\Users\Admin\AppData\Local\Temp\3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdcfab46f8,0x7ffdcfab4708,0x7ffdcfab47183⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:83⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:13⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:13⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 /prefetch:83⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:13⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 /prefetch:83⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:13⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:13⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:83⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:1076 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6780e5460,0x7ff6780e5470,0x7ff6780e54804⤵PID:5064
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:13⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:13⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3180 /prefetch:83⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:83⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5984 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,9507271845748443346,8374190852593633448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3192 /prefetch:83⤵PID:2040
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3209ff38c8b8f1872723539b972d9dce97b7544b5202fde3b3dd464f8ad34730.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵PID:4820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfab46f8,0x7ffdcfab4708,0x7ffdcfab47183⤵PID:1676
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58be9513fd38b94d4f6b5011b68b60326
SHA147feef421fe8de09e36ca685e9cf19d404aa8917
SHA2565bf3203e8be948e62917ebab13e1b21aec105c473089b233874fac8e5748bb2d
SHA512cb3dbfa46f3ee28956deab38fefa8276f9efa6ea978ff6b7f810f7f9ba106ed569f017cf5c840ae90fc5f83a1e6dbe50efef8e3412f4f38452a00915b2cc58bc