Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
1295bd2ba472dc2175049b89a3bd9986.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1295bd2ba472dc2175049b89a3bd9986.exe
Resource
win10v2004-20231222-en
General
-
Target
1295bd2ba472dc2175049b89a3bd9986.exe
-
Size
14KB
-
MD5
1295bd2ba472dc2175049b89a3bd9986
-
SHA1
3f7788d5beae74893d9f1ea2db817803503e44a1
-
SHA256
e3df98b51d861e3b63fec904f84e269c01499c403aa536f9ad2ad4dc1da0e5e8
-
SHA512
80788ed9c22ad1f53fb4c478baba800846bdd8328e964f1be6345131023e0e0bfc8203555df69fdd9ff382e0d9369634fe08167d350611a2dfa659620104e3e7
-
SSDEEP
192:nlUC461A/0LiQxqfKD6VkagfWhiQ7SMrZQl96Sd/Cv+OHLQjcWFDZgmC:lUFx0iQxqslQm39b/QRLAzFDZgmC
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2216 msedge.exe 2216 msedge.exe 5088 msedge.exe 5088 msedge.exe 3984 identity_helper.exe 3984 identity_helper.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe 5088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 5088 1540 1295bd2ba472dc2175049b89a3bd9986.exe 36 PID 1540 wrote to memory of 5088 1540 1295bd2ba472dc2175049b89a3bd9986.exe 36 PID 5088 wrote to memory of 1012 5088 msedge.exe 35 PID 5088 wrote to memory of 1012 5088 msedge.exe 35 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 628 5088 msedge.exe 43 PID 5088 wrote to memory of 2216 5088 msedge.exe 38 PID 5088 wrote to memory of 2216 5088 msedge.exe 38 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39 PID 5088 wrote to memory of 4776 5088 msedge.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\1295bd2ba472dc2175049b89a3bd9986.exe"C:\Users\Admin\AppData\Local\Temp\1295bd2ba472dc2175049b89a3bd9986.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com.br/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:83⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:13⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:23⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:13⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:83⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:13⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:13⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:13⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:13⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3b1a46f8,0x7ffc3b1a4708,0x7ffc3b1a47181⤵PID:1012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4632
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4168
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv cArtOXQLuU+cK7Cqt8GxBQ.0.11⤵PID:1032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5ad6d1bdb24dd919c2a059a7ae58f9cf0
SHA17643eda33c4f4c9b8ad5799731ec9f48c09b3d13
SHA25655cfc06706cdf96c951a024d0cad85720f7987457337bc0dc589a1dd8a18c453
SHA51297d7aadf85288d66277afab539519d55589414a8ded05123a844e67b402018de595d693330b0ef8bd1fb0471abe2f1b469585c50903f3c6b7938348ee76550a4
-
Filesize
981B
MD51639abfa651c37cfdcde499aec6393b8
SHA1c0eebacb7e700148e43db171e84e0eda814628e0
SHA256760a7b30cb4ecb4058d4acfbbffb88746fc9fc595b354eff6b047dae13aac1c6
SHA512481c1de86e6053a09c9d8e77b1d0f88ea4c0fe5969b1a6f02b3ec55c897677803e6f7df53ce7057aff37df1ea8007160dfbb2a0f08c79ae8f08ad2de79fa680e
-
Filesize
6KB
MD55387735ce37389e629f37f79a72167c0
SHA14e4ff4b9eab4654629382642b9ca0845eb25b40b
SHA256cf451281a90f811e261ac9ca5ccf2b6db3180967236963eb9a03c51407d7cab0
SHA512d5ee386af37b7dfb9587bccfbc8875249084b7432b0f269fcf67f86f12a2f48b6b9894fc1bca302e8a58968f449a1f17565304b7db684d3fb8a13a1b7a267335
-
Filesize
5KB
MD5d82853230eaddefaca6c4c5aee693e33
SHA1a78e37b073bb02e728d7564dc69de3a9b14b9ecb
SHA25687f2c15f8788533bb9c566c48d617bf928268985d1e04582182123b08054ef24
SHA5127ee89b76173c6e6fb6658df0673d1c692ae5c690a7382d277e015c7d79c7da0ee1d5e79236a6f84da6b17cf55910f752e37754c8da66362020b96a8581ce7c94
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e514eaa1b0fce0b24ce23a86417ec52d
SHA1a3d5e35ecdc42b11b3d7c7e4f5bd8441a0985836
SHA256ef4db65fd90efe433b6db6a499ecb14a09ef15ce1e28d5d717c6bca10f0363b4
SHA512315e06a99666bbe9027ef327bb1d6d5f654118ba422991fc8a4e6b082cfbdde4d70672f5672c3eb51bd793b7a3d6e47d2110b7a6a082fbe51847f77aa2c0c9e3