Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
51769e665419097303af1ef8e9ae9b9b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51769e665419097303af1ef8e9ae9b9b.exe
Resource
win10v2004-20231215-en
General
-
Target
51769e665419097303af1ef8e9ae9b9b.exe
-
Size
78KB
-
MD5
51769e665419097303af1ef8e9ae9b9b
-
SHA1
bb7791df653773857a7e1b926985b3a8e6d42605
-
SHA256
58295fc2aeb4cab2641ff58397528d8be0d232bb8a4a1de3ece0c71085856463
-
SHA512
59b6bd5fc27bb4fe19eeeedb2c53ac1d33b8ddae7f1920ca46aa110e2fc042ec7e27040b01448a67f05be078ba2e56718b242078ef53cb7f65c32a9c169345b6
-
SSDEEP
1536:7RWtHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtes9/G1Oa:7RWtHs3xSyRxvY3md+dWWZyes9/i
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2736 msedge.exe 2736 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 4312 4256 51769e665419097303af1ef8e9ae9b9b.exe 93 PID 4256 wrote to memory of 4312 4256 51769e665419097303af1ef8e9ae9b9b.exe 93 PID 4312 wrote to memory of 1128 4312 msedge.exe 92 PID 4312 wrote to memory of 1128 4312 msedge.exe 92 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 3616 4312 msedge.exe 101 PID 4312 wrote to memory of 2736 4312 msedge.exe 94 PID 4312 wrote to memory of 2736 4312 msedge.exe 94 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100 PID 4312 wrote to memory of 3112 4312 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\51769e665419097303af1ef8e9ae9b9b.exe"C:\Users\Admin\AppData\Local\Temp\51769e665419097303af1ef8e9ae9b9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=51769e665419097303af1ef8e9ae9b9b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:13⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:13⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:83⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:23⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:13⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:83⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:83⤵PID:592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:13⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:13⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:13⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:13⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:13⤵PID:5324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:13⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13278927757790331396,5642116079077179125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:23⤵PID:5260
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=51769e665419097303af1ef8e9ae9b9b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffbf29946f8,0x7ffbf2994708,0x7ffbf29947181⤵PID:1128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2380
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf29946f8,0x7ffbf2994708,0x7ffbf29947181⤵PID:3124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize264B
MD54e7347e401656ffe7a68670751a1a9cf
SHA1573b659704f75f321064564c38294a22665fe0a2
SHA2565dd96d1740b0eeb03cee71b16f58aee8e2add2a8c0fcdbefb8448c5ea499a5d3
SHA512dcb127218564b264f96abdce2e057b57b38c27692f935df94b1c01f32b15116e87fa5fdc10e20d0862a417d75dd80c469a748b310918b583874b821861102ba4
-
Filesize
437B
MD505592d6b429a6209d372dba7629ce97c
SHA1b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA2563aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa