Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
272s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25/12/2022, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe
Resource
win10-20220812-en
General
-
Target
bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe
-
Size
5.6MB
-
MD5
e16a355aee8243229bc2eec7bda6e79b
-
SHA1
98f106c66a189615e8c0b21e674c91f3d858cdc4
-
SHA256
bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d
-
SHA512
5a11ceadadec78a4f0b61e67ab3b5ff5b17fdb441f165b2043d9e31f3602a6485d2f03478bb0cf9b0392e95dc9f3c1a3a7880a0d21e4d8037b65f5f0d6ee17fc
-
SSDEEP
98304:tvw163r7GK04sp4BkAY43WiPBIHHyIWd36hth1Gd0GHeLhad/fdX+IrR:4IYX2BkAYwWiPBIHH6d04iAetUf9+q
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2716 edgeTaskUpdater.exe 4084 edgeTaskUpdater.exe 1288 edgeTaskUpdater.exe 4268 edgeTaskUpdater.exe 4440 edgeTaskUpdater.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2716 set thread context of 4544 2716 edgeTaskUpdater.exe 71 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2396 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1760 bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe 1760 bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe 2716 edgeTaskUpdater.exe 2716 edgeTaskUpdater.exe 2716 edgeTaskUpdater.exe 2716 edgeTaskUpdater.exe 4084 edgeTaskUpdater.exe 4084 edgeTaskUpdater.exe 4084 edgeTaskUpdater.exe 4084 edgeTaskUpdater.exe 1288 edgeTaskUpdater.exe 1288 edgeTaskUpdater.exe 1288 edgeTaskUpdater.exe 1288 edgeTaskUpdater.exe 4268 edgeTaskUpdater.exe 4268 edgeTaskUpdater.exe 4268 edgeTaskUpdater.exe 4268 edgeTaskUpdater.exe 4440 edgeTaskUpdater.exe 4440 edgeTaskUpdater.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2396 1760 bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe 67 PID 1760 wrote to memory of 2396 1760 bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe 67 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71 PID 2716 wrote to memory of 4544 2716 edgeTaskUpdater.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe"C:\Users\Admin\AppData\Local\Temp\bccaebaedd0ef46f14b8ac4e2bd62c73f722aba8e69ddb328b3eb97949a1919d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "EdgeUpdater-Task" /TR "C:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe" /SC MINUTE2⤵
- Creates scheduled task(s)
PID:2396
-
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵PID:4544
-
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
769.4MB
MD5df16c1cf93ac7434e375ddcaf0548e36
SHA13cae04a46bf496a25ef4b66d8a4e4fdc05fbe5db
SHA25652e1444ff5e31ad2fa90f5ec322378cec19149557c631ee0b24da76bd4d03a6c
SHA512e1f7d81dd7a82cc866dbf26c6a47e8642091b9c8bffe9e9cb3b2e9af95d913c3e803d328cfb8cf3e8cdcb83e1474e9e79e2a5b809cb993067506cc3f897f866e
-
Filesize
767.6MB
MD56af8769e2eaaa68de9f5dbf007b9bec2
SHA17519ccae1046470825893e198785eb3174331ebc
SHA25600720ce85d714c9a63933e8e897129c4f794d4ae658715513fd83da975744e29
SHA512748f3dab75dc5f5064983f50c3dad4dcc1d300cfb0cb5fc003c96f91d9d222b56b1c13a6b5ee30f30fc320af6297c8766afb26070c348b6482c4b73093fba7ea
-
Filesize
530.8MB
MD5048cd504ea5f6b4ec53e58a49b4e6507
SHA1209dece48b47c4c6092eae4320718a70b553530f
SHA2569016bcb3204aed7ba4cc504b7c860f4de8d63ff3ee71767c3708b2bb23e4336b
SHA5125f7691b389b44a05c9e3147690fd304caa4144fc1710b6eb8ee4970c99cd35bd383cb81b4cdf3c9adcafd0d8f5047b64de42d65022ef9b267f1ca0f85e150d31
-
Filesize
366.2MB
MD52fd041b82992449a197f27af8ee6e44f
SHA10cbdae69499996a3a38e295b15830d6b6064d6d6
SHA25674c968323383ecfd05b09d4c314f7ade8c1ecfc6ff5ccc0d752c22b1975b4756
SHA512c609e679efc027c7d2036847d9409d981b8e6faa579e068946d35d8694a033b35b2da60fb94258395f29bc16d5f16528dd74983a6a44d7de62b0a886bebf740e
-
Filesize
186.1MB
MD58dc5ae7a3ee8ab45249c40bcde353acb
SHA1395fd71aea64b27aa14505ada1d30c4dce970dc7
SHA25672fa1889ac6240739a6bec362e69795ae910e080f1a025e6439df6b07ad3603f
SHA512c4829de9bd736f8ad253593dcf270614ee6c8aeca977d4eedb466bd99038a6da1062580b6d9766f17cc556cb8e3603781c0e1e7591c2deb6193e6b919c315f7e
-
Filesize
21.8MB
MD5346113a50cd9abff34e1c68ea1da1fe6
SHA1994ce51aa960974956fb2c79c359c97907368367
SHA256f13d90a1fef9bbfeb85d4ad99b45a981e882ec96e2764c48585e7b0438d3a104
SHA512532e44d5e44c4e62f8bf7b3ec85c8070fb48cc04646e63c5adbaeb0423d3f9019dd2385761f487853d16a508cad2a2130c1787862620689c2accbbaaf77e7de6