Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
74343367368864edb0131d546340e79c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
74343367368864edb0131d546340e79c.exe
Resource
win10v2004-20231222-en
General
-
Target
74343367368864edb0131d546340e79c.exe
-
Size
206KB
-
MD5
74343367368864edb0131d546340e79c
-
SHA1
a5e8a611c1a4dbc6a138a82b39a5ba8df6eefe99
-
SHA256
0501f6db98e0a6a2d1620ee6635d510b258c1ef58dd2e275c8fdf5c4876dde7d
-
SHA512
324b8fc00568a3057438ed1e93cd95581517065079308f5d92fe8bdee6e64d998f6f747307da200a076b128c593f85422e9a0093c5c91cf6ae5f08d019825b92
-
SSDEEP
6144:KnIUVAUVSNWm01TsCKgTlBE+eZ6GurUZY5l7:Kni/x01oCKGBE+eZ6LrF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 4852 msedge.exe 4852 msedge.exe 3488 identity_helper.exe 3488 identity_helper.exe 4100 msedge.exe 4100 msedge.exe 4100 msedge.exe 4100 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4852 4252 74343367368864edb0131d546340e79c.exe 87 PID 4252 wrote to memory of 4852 4252 74343367368864edb0131d546340e79c.exe 87 PID 4852 wrote to memory of 1508 4852 msedge.exe 88 PID 4852 wrote to memory of 1508 4852 msedge.exe 88 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4580 4852 msedge.exe 91 PID 4852 wrote to memory of 4072 4852 msedge.exe 89 PID 4852 wrote to memory of 4072 4852 msedge.exe 89 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90 PID 4852 wrote to memory of 5100 4852 msedge.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\74343367368864edb0131d546340e79c.exe"C:\Users\Admin\AppData\Local\Temp\74343367368864edb0131d546340e79c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.adobe.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash&Lang=BrazilianPortuguese2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0e5f46f8,0x7ffb0e5f4708,0x7ffb0e5f47183⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:83⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:13⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:13⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:13⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:83⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:13⤵PID:956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:13⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:13⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:13⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14108203619499180869,5624742550628675719,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5c7ddb457ec8feba7b7753aee146ad779
SHA1822f798a57ae5bc966c1a23f948f3ac5190db5d9
SHA256bbf4f042e9e2c0e4a7f79fdc4f8640cdc69f0ee6d10d3d05f23b809bad842cea
SHA512265ef9409a957ccc7648d66e09adf9e107d51d695c3a0d8a501a55ab8cd2c4827f19920fa09cf43afd05d25eaf9b2780c3078d65e2ab36bb687eecc89ec45f2f
-
Filesize
1KB
MD5f41208b42a7459ef9bbe2cbeee1bea55
SHA116fd7f7e170c1067a4b79030a45e8d35d3e83409
SHA2569613a6765e08204c35edff51d8faec1e89146956062f4df03181a845f6592c9e
SHA512701739b217488ce3a58e0ddfdc941fd8a3cf861957fcdca9bf1e9a70bb2c963703abda6eb7d3969dc9fc61eab8785095b64b47e688d9d36b47b960aa3cdc5d66
-
Filesize
5KB
MD54646a23a4cda9dea1caef247e73a7980
SHA1a6476ec0ed2bff74a908649eeb32182d9f7e5f75
SHA25629e4dce94675e0aaedc4a01835e35c9cce0da96937ce5d99274e3dbdbfeb8194
SHA51254a812d5872b8786a0045c0a913dfdac028c83d460a02142a0171bced4a86692d3ef33636df93e011abceeebada5504d045dc89cc9316dc1e31a6a3e646fc6da
-
Filesize
6KB
MD5ce47457c13d5216914a78efc908d6b74
SHA1bc2b56359e8e0c4691d399a7364d0e30574ffb2b
SHA256a68ff8c9b889298ed1344c1a6e13b062338231474dbc7d320b96580e81ef1e28
SHA512af7986353938befc18cef1f6f29e29bd7a716e280fc85c36f7be2b0e7dd5aecf926a76c72319f16e72db5f1ea26a30c94601a516dd65df234437832f008b3ea7
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b6a4fdaaeeaf94f96660e2d636f7a2fc
SHA134872af3d9bf9c37667ea2b7bc640b3ae3ac67c9
SHA2566c16523786e9f61e7f43a1c2ae7f9058e4bd814f3daca3dbad6f4d1713f74142
SHA512832070505da37f4cde530bcbb366a08dd607b9bbeb71c3c19d3777828c26fc9d8bc40e6f78f62733415f8275401cc89dbad9b3bdc7733689da0970f13e7898ee