Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
9813d267b94ffabfb4e246fbaa7df131.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9813d267b94ffabfb4e246fbaa7df131.html
Resource
win10v2004-20231222-en
General
-
Target
9813d267b94ffabfb4e246fbaa7df131.html
-
Size
3.5MB
-
MD5
9813d267b94ffabfb4e246fbaa7df131
-
SHA1
586a687be2c0615d19710fcb2a9b969cc5fd925f
-
SHA256
8bce2a80a2bbc941a46d6bc278826f142f2c4968c78edcc60cf763b6ff89545d
-
SHA512
e2bc4453af68e892c5f6a9886eb1a1aa9c211431fe8ccd39fc80b09cf3c49497b5566bc18152769dc73e156140b3bf7a05701f8071da93480560077471eff26f
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfm:ovpjte4tT6Nm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 1180 msedge.exe 1180 msedge.exe 1096 identity_helper.exe 1096 identity_helper.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2936 1180 msedge.exe 83 PID 1180 wrote to memory of 2936 1180 msedge.exe 83 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3496 1180 msedge.exe 85 PID 1180 wrote to memory of 3500 1180 msedge.exe 84 PID 1180 wrote to memory of 3500 1180 msedge.exe 84 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86 PID 1180 wrote to memory of 4076 1180 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9813d267b94ffabfb4e246fbaa7df131.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdde2846f8,0x7ffdde284708,0x7ffdde2847182⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4700161544485167720,4292739763489649472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e71d66ce903fcba6050e4b99b624fa7
SHA1139d274762405b422eab698da8cc85f405922de5
SHA25653b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA51217e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32cf98c2-0116-49dd-9aef-f9cf79f6d42d.tmp
Filesize5KB
MD51f4330f24f6b32364ac647f723058a9c
SHA1d77c39a769c57c0b1d02dec455f012e0075d2949
SHA256a0699f679617282eafa424340e1797492c6edec34e54caa897036ddcd44bf443
SHA512865ca618c4ca04ef1518f50a9948374fff0ba5e22a26634ee5572b6d419832676d051cd362c9865e5fafb838ebb4d8b90025ea90288ddeb7602aaab26b2d6c5e
-
Filesize
981B
MD53b4edc1190bf520a0b326ea37ad13c19
SHA191be5279dadaa58c0faf29bd0ce47a18ed562d7e
SHA256b84771cc7cc7cf8941c74fa5f83cb14c66a37e96e46ee7a3cc7b83b41887c0b8
SHA51227b42d79cfa37d576107f89a10cbbed96bad7a919e3a9a7adadf13dbf948027d94271d2c610df370d843ad2e8a76101db193c02648ec52b27f3e211395a43581
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5f3e2ca6bab6f61cc621bde54ded721cc
SHA1601f30992a0161acaf5f10539bad10c775ed758b
SHA2568cd1f53c240f4b6f7183ea0db8f74ac4e84d81cc53a9fbe256fe68166e81ca78
SHA512aa2e3b3d4d9a0fc2bd763facc424992e5ec6b7b575d8bef20f11a925fdf776330332c1ca2f8fa71131b80bb64fdde4e7fd8d96d49aa409667cc1631227bc403e
-
Filesize
24KB
MD51b1b142e24215f033793d1311e24f6e6
SHA174e23cffbf03f3f0c430e6f4481e740c55a48587
SHA2563dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
SHA512a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5fec42e06224163726a7b0cfaf03cec36
SHA129bbe16dae38c71567c639c4523670b0100bcdb6
SHA2560e82ce180eb4eba592e3c51efaa8e4e6b2e14e451078d700796f78fd2bcd8677
SHA512d2a91a95ff3f8d15578d5c6116a5996a4ee62f5f6019f783702fbec6edc6868d71c222303455c9756f53ea7effd01afc740f27e67b289fae614d84404bc560b2