Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
9b1703a80b8418eeb3f64129f4b8e260.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b1703a80b8418eeb3f64129f4b8e260.html
Resource
win10v2004-20231215-en
General
-
Target
9b1703a80b8418eeb3f64129f4b8e260.html
-
Size
45KB
-
MD5
9b1703a80b8418eeb3f64129f4b8e260
-
SHA1
aa8643f9cf14c6a3a56b3d72546bf650a6682857
-
SHA256
12e74eb212eeb240c109ff105af3ef11d1af00118b48792029db19fe6406055b
-
SHA512
602cb5518136437ab77b5e9984dee537c0e30ef3eaf884084c1ede7e53fcbf76b0384204d5762c1512002477cdab15c9dbc89adc05da3e92b1573617a116301c
-
SSDEEP
768:/8kI1yndfNRNdGiiT181VxEO4iY6iYRP2f144:/8kI1yndV7dGiiR81VxEODE144
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3656 msedge.exe 3656 msedge.exe 4796 msedge.exe 4796 msedge.exe 2312 identity_helper.exe 2312 identity_helper.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe 4796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 2928 4796 msedge.exe 61 PID 4796 wrote to memory of 2928 4796 msedge.exe 61 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 4476 4796 msedge.exe 86 PID 4796 wrote to memory of 3656 4796 msedge.exe 85 PID 4796 wrote to memory of 3656 4796 msedge.exe 85 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87 PID 4796 wrote to memory of 3720 4796 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9b1703a80b8418eeb3f64129f4b8e260.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe5e346f8,0x7fffe5e34708,0x7fffe5e347182⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14226518142999572024,8550717473584013680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55e77545b7e1c504b2f5ce7c5cc2ce1fe
SHA1d81a6af13cf31fa410b85471e4509124ebeaff7e
SHA256cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11
SHA512cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72a553fa-5b13-426b-a588-fed3dc5dfbaa.tmp
Filesize5KB
MD5315e6d47cf0ee4b310eac18dd58a368d
SHA11510f9f425172fc8e143429fe0d1b61026f0bb87
SHA256ce18bfe16304730ee22a8ce9a05cb2c53a80f94e11af47b45bb691b561a0e883
SHA512efa29de2e1b92a06885f4d6d775ac48390a72b88f1f1826bf547faa967a3c2579f089332eb14b8d60f212ac77c4096d5ea5829018b7cd9dd14d4a473872770f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5d223937d5c43d0f27934ad44e41994e4
SHA1e05ecab41a756d56d2bb451a9460302093536967
SHA256f3e5324d7471408b1cdd788bde2a3e67a4bb7d796283964a4ce4cb2ea8e92ded
SHA5127bcd6d307d286fb360c50cb69a5c222c554fc049a711355636692372b44219cf23b65303cea8793db089be89c1ed3bca249a15e3c0524c61db3855e6845cc81b
-
Filesize
189B
MD5443319881835b14fda88caab9945e84c
SHA1adb420bd20774e8eabc4d3d53ecfccb20ae7cb54
SHA256fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da
SHA51239c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD534263c467116b5c7930aa6e913a1679a
SHA1a40e06963ab10dc0b76a7d2a94f7db19b4e3f98a
SHA256cef1282e713f32c3ab8a2f0c834a754289312cca4959f5333450147b8cdcdcaf
SHA512d3e3b71cca3be5c56da1b89091c9eb3b995157f9b6733afc11a1fa0174375fc73a2be700c1dddde0508cef180f73750800214f0f9daf85db3f42e0c20d5c5768
-
Filesize
24KB
MD56db2d2ceb22a030bd1caa72b32cfbf98
SHA1fe50f35e60f88624a28b93b8a76be1377957618b
SHA2567b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4
SHA512d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51ac0c2d937a80e60899bd9720e51868a
SHA192e34a699d6f9bcd5e6356540c920f94209a8f14
SHA256eb0abc5fd4f8edec3341023ee6cdd08dc7214bab635ebff50a63d2ab217bae3f
SHA512c13c38a1d99bb320b0f4996b5b59ab967d8df20bb6344604a5a3b673a2e944b1184c745728bb7bbad342f264ff6e1fcd51e3924e7d2a25195b67e7a806b6f1d5