Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe
Resource
win10v2004-20220901-en
General
-
Target
979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe
-
Size
558KB
-
MD5
9d46df79329e1181e232d31990ba673f
-
SHA1
87227a78bbd49655be0abdff2afde4a94f5d4a57
-
SHA256
979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797
-
SHA512
c5d96dbf90b12233bc04e8a64b63eebab3f28d487388d7eda02e1efb09ea0da23656701369abdee9d93fe31fe13a9dcee8a86b9fa8c9f042d61aa876675de6c2
-
SSDEEP
12288:Uhbk39tLxU8d7EZ/fQdAhecXzbULkt+SYE8Uam:UhYt1xU8FAXVheCnFam
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ed56fbcb-a29f-4435-8487-b82b5d9c9051.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221029062413.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4144 msedge.exe 4144 msedge.exe 4864 msedge.exe 4864 msedge.exe 1932 identity_helper.exe 1932 identity_helper.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 804 wrote to memory of 4864 804 979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe 83 PID 804 wrote to memory of 4864 804 979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe 83 PID 4864 wrote to memory of 1392 4864 msedge.exe 84 PID 4864 wrote to memory of 1392 4864 msedge.exe 84 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 1848 4864 msedge.exe 86 PID 4864 wrote to memory of 4144 4864 msedge.exe 87 PID 4864 wrote to memory of 4144 4864 msedge.exe 87 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89 PID 4864 wrote to memory of 2036 4864 msedge.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe"C:\Users\Admin\AppData\Local\Temp\979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.java.com/pt_BR/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff8f90c46f8,0x7ff8f90c4708,0x7ff8f90c47183⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:83⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:13⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:13⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5300 /prefetch:83⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:13⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:13⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:13⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4084 /prefetch:83⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:83⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4628 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff79ea05460,0x7ff79ea05470,0x7ff79ea054804⤵PID:2904
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:83⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6480 /prefetch:83⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:83⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:83⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5752 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:83⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,7548407516413308571,3076300190380681929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 /prefetch:83⤵PID:4464
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4804