Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe
Resource
win10v2004-20220812-en
General
-
Target
a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe
-
Size
70KB
-
MD5
7b29739caa0d61a19b13de0736fdfda4
-
SHA1
d7c28036319e55cc25311b1b7c41185e8268a55f
-
SHA256
a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8
-
SHA512
faf1447090b1c8ac25d6d6daf5c0f3cec8df5f65a96b683705f39c45f6002a94029ff6ec7dac03adcc07e7c1fcd4c9f9867137b46ef7c1bbfd4d3d0ddad39817
-
SSDEEP
384:7ll77pFDFTxWL3dZHrliqis9QlcffyqGe4z:7tTxk3dZLJisKl4qR
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0bc8f688-4440-447c-8cde-6cdee925e38a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221206112828.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 3592 msedge.exe 3592 msedge.exe 2576 identity_helper.exe 2576 identity_helper.exe 3732 msedge.exe 3732 msedge.exe 3732 msedge.exe 3732 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3592 msedge.exe 3592 msedge.exe 3592 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 532 wrote to memory of 3592 532 a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe 80 PID 532 wrote to memory of 3592 532 a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe 80 PID 3592 wrote to memory of 4060 3592 msedge.exe 81 PID 3592 wrote to memory of 4060 3592 msedge.exe 81 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 3656 3592 msedge.exe 84 PID 3592 wrote to memory of 2616 3592 msedge.exe 85 PID 3592 wrote to memory of 2616 3592 msedge.exe 85 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86 PID 3592 wrote to memory of 4920 3592 msedge.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe"C:\Users\Admin\AppData\Local\Temp\a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbdd0446f8,0x7ffbdd044708,0x7ffbdd0447183⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:83⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:13⤵PID:672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 /prefetch:83⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:13⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5664 /prefetch:83⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:13⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:13⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:13⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:83⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:1912 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff61ac85460,0x7ff61ac85470,0x7ff61ac854804⤵PID:4272
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:13⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3600 /prefetch:83⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17998466618287934662,3743792716815778526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:83⤵PID:5012
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a012d95f32af6083d926ad249c42fcc1641cf5b25410c10a315a0d16abf2e8c8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵PID:2576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdd0446f8,0x7ffbdd044708,0x7ffbdd0447183⤵PID:5004
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b