Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 22:48

General

  • Target

    97cf1a655ed9af3c865d74d26604ffaf.html

  • Size

    21KB

  • MD5

    97cf1a655ed9af3c865d74d26604ffaf

  • SHA1

    c7305b4381cf4853e6291576f4e69e5b673abb57

  • SHA256

    c3b5a257d40fa3b4c6ee75cc405741a0b127251f845c5b8e59f596301168de14

  • SHA512

    fc1be9a35918280c5cd53889c3705644c63492cdf558ec2c8aebc8b8305e37df027faf4ddcea73103b81f15104b42d4cb2ae5f31ecbab541030510205e7f679a

  • SSDEEP

    384:QfRIjUDGO2G9kLL9j9F2OznTEDdJ11vFlFt9kitZbRJgR5MKxvZH8lpdCjRWyZWX:QfRIjUDGO2G9kLL9j9F2OzQh4e4RWKxy

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\97cf1a655ed9af3c865d74d26604ffaf.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff932b246f8,0x7ff932b24708,0x7ff932b24718
      2⤵
        PID:4528
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2028
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        2⤵
          PID:4088
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:1624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:4820
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
              2⤵
                PID:4664
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                2⤵
                  PID:640
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                  2⤵
                    PID:2324
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
                    2⤵
                      PID:2788
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
                      2⤵
                        PID:3016
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4960
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                        2⤵
                          PID:5028
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
                          2⤵
                            PID:3128
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                            2⤵
                              PID:884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                              2⤵
                                PID:4632
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4869089544735798929,1088613230411607118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3880
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1824
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2884

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  5e77545b7e1c504b2f5ce7c5cc2ce1fe

                                  SHA1

                                  d81a6af13cf31fa410b85471e4509124ebeaff7e

                                  SHA256

                                  cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

                                  SHA512

                                  cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  72B

                                  MD5

                                  719d43f8e813bbf47eb933cdb5df3934

                                  SHA1

                                  dc86613eaebd013d15da32e132aaef569fe8483f

                                  SHA256

                                  3b713d1f8d6081fe620e03c4fed626ca5e94d08ef4dee9056ad1d9a04f0847dd

                                  SHA512

                                  2f955182608199237346764a629ac05313356e90885cd76ce70075e8b5fc82ff3de680d7a98497e35b418f1390408ac5adf0d76c99e2249fd2558b55f8422d68

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  111B

                                  MD5

                                  285252a2f6327d41eab203dc2f402c67

                                  SHA1

                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                  SHA256

                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                  SHA512

                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  812B

                                  MD5

                                  975061ea448cfc48b057c5304ca47ac7

                                  SHA1

                                  3051da67a4f412eb573dc813889e414a7cf2ba68

                                  SHA256

                                  b1b195c1b498ba7a8d650f414c85b81e770a6dd79ac8ceb7dc2af604d0366d16

                                  SHA512

                                  9c7412ce612345aed50fa9a5dd6cbbd34010c7c934b4779e01052e91611a584469fbd00cd5cbe5e4e702402af2347fbd6bba775ecb0bf0a738e6505440042bc4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  03b9ec473c52173bb551a192b3d35959

                                  SHA1

                                  0ce265cd10789a2e79317a3d043bd758518ef45c

                                  SHA256

                                  7bd1db3bafe4ad65282e31fdf46715b91524626f3a20fefce54b886297b8079d

                                  SHA512

                                  24145c646f3f8cd1eef6548a640b01b80650fb83da2a569bdad3bb3c3d45d8c1e79d78557238fcc366ed96c36038d9db89bda85f38fbd8641b45a2836c0d3386

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  4bee27802377d04786a0151d9f681069

                                  SHA1

                                  b3c4e0c57a2d71a4aed516b8c1bb2984ff2afaaf

                                  SHA256

                                  4b1f148ef46e330f5041d85d7aa3473f9a571eb9ef40e79baefbe582e211ede4

                                  SHA512

                                  e70e2ea75f0f92e52a8e7e2d007c44c6e8b825bbf8fdb4e3388eceb9e203dcc9fc349a4b6097ee7f9b1583a1f3d383a5ffd32a6b66c4e6b842b16f3b74d01555

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  ac8f3e1ee82731351ee1a7593236a64b

                                  SHA1

                                  20d199051dd9b81ddc689ec0ab6d724bfb074fde

                                  SHA256

                                  6e0af890bc138de75ed8faaecec39e487f1bacb0abcaf33936dfe869c1bddc00

                                  SHA512

                                  81500f40f7a5bb4d67d559c30a312d9029305ab3c1cdc2f6fbf5d9b06e5291449ae2e840d2c92f38b9d3e9dfef7e101d59c5807e9ffbd87db43f36902c35540c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  841cad18dd7b418577a0d759464d719b

                                  SHA1

                                  f4ec922a38c2e1143aae1d245c464435af9e3854

                                  SHA256

                                  ac3e41064ed51b73904d50846bd504ddc0f69ba3937da423ce06f5caaed2306a

                                  SHA512

                                  a5350f47a9ed5cbb2af83609d8ac0388234ec617e0c7be214fdf5bb879daafdd929e17e20bb36ccade49760e0d592c7529a7f3f12030345c3fe49f17537490fd

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  7ac10de7d09d9ca054924caf5bacb77a

                                  SHA1

                                  25c41b19ef547bb14376086405d107c305c23db0

                                  SHA256

                                  852919b399913db296a333f0ae34629554bfb95987028199b3f2b90a020a9304

                                  SHA512

                                  33a25762c8ef0bddd1726288b49222f7fa15cb90001c79765f593de6bfa11f0ffe5d63397e19fc9bf2226b0c4d2e8d481d66847a285de2f37978f2fe77aa937e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  a45b26dedd9c6c2b42fbbbac13975604

                                  SHA1

                                  03187a33e3c2b38afe7dc82cd943281b1d1d2a13

                                  SHA256

                                  919a95bda7abedfa883bb2ea802530d3f605fe27a2f4ad4c10f49e3c3634a81a

                                  SHA512

                                  7df02df347fed56a3db89f537e37601fdccf2a65fc3d798b79671da87e139c3267bc0d017ceba3bdb72c05a5a3b2724689d21ca1bae3a1706bd196f5f238f8df

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                  Filesize

                                  24KB

                                  MD5

                                  6db2d2ceb22a030bd1caa72b32cfbf98

                                  SHA1

                                  fe50f35e60f88624a28b93b8a76be1377957618b

                                  SHA256

                                  7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

                                  SHA512

                                  d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  bdc7a8d3d8ca5d092c8edb27044fcf5c

                                  SHA1

                                  a233493b2a6671cd405789a2d189e9095ba98198

                                  SHA256

                                  65f4018d9694d8554f82e3275296bcfff0f11a2a08a3fc66b08ecc32cf267c0d

                                  SHA512

                                  46cd4f3339de3bf23301ccd19c050939932b0f15dbbed258d882f1c8a3d60c8c434bf4920c73c7b6cc79d2a05d3ee3ebbe78d983ff1b369bf809094c48df2587