Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 14:46
Behavioral task
behavioral1
Sample
209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe
Resource
win10v2004-20220812-en
General
-
Target
209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe
-
Size
479KB
-
MD5
d51d291cddbeb4e6277e7cc0553cb830
-
SHA1
418739f762a23d7e5bdcf1e15f44cdf9237175a9
-
SHA256
209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8
-
SHA512
e54e5511f81596ce1ee2fc87c5ab76347b29585c9761665f4c5dcab786677c772926ed09ff2c255445d48293367ffd6d602a1fcb274b1607ca531cf0119c34aa
-
SSDEEP
12288:Z8/p7VZrTjcvg9OmLP2NrHD0DZ+e32APuGw:e/dVZrG5kux052APA
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\641fd670-570f-4085-8589-e219115f7b00.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221201004517.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2328 msedge.exe 2328 msedge.exe 460 msedge.exe 460 msedge.exe 4072 identity_helper.exe 4072 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 460 msedge.exe 460 msedge.exe 460 msedge.exe 460 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 460 msedge.exe 460 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 400 209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe 400 209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 460 400 209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe 81 PID 400 wrote to memory of 460 400 209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe 81 PID 460 wrote to memory of 1236 460 msedge.exe 82 PID 460 wrote to memory of 1236 460 msedge.exe 82 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 4388 460 msedge.exe 85 PID 460 wrote to memory of 2328 460 msedge.exe 86 PID 460 wrote to memory of 2328 460 msedge.exe 86 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88 PID 460 wrote to memory of 1888 460 msedge.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe"C:\Users\Admin\AppData\Local\Temp\209b71e5ab7b8cbd538b0fa08ad8276f25c99d552b9bba3c68cca8f0b4ea22b8.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.qzonebar.com/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7b4446f8,0x7ffa7b444708,0x7ffa7b4447183⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:23⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:83⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:13⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:13⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4988 /prefetch:83⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5716 /prefetch:83⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:13⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:13⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:83⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14107333263679371733,9113717586822928607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:552 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff78ce35460,0x7ff78ce35470,0x7ff78ce354804⤵PID:4712
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3808