Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3dex.py
windows11-21h2-x64
8index.html
windows11-21h2-x64
1launch.bat
windows11-21h2-x64
1objects.py
windows11-21h2-x64
3olympia.py
windows11-21h2-x64
3pyarmor_ru...t__.py
windows11-21h2-x64
3pyarmor_ru...12.pyc
windows11-21h2-x64
3pyarmor_ru...me.dll
windows11-21h2-x64
synapse.py
windows11-21h2-x64
3Resubmissions
22/02/2024, 23:12
240222-2695bsgf99 322/02/2024, 23:07
240222-233wvagf86 822/02/2024, 23:03
240222-21plfagb6x 8Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
dex.py
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
index.html
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
launch.bat
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
objects.py
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
olympia.py
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
pyarmor_runtime_000000/__init__.py
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
pyarmor_runtime_000000/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
synapse.py
Resource
win11-20240221-en
General
-
Target
index.html
-
Size
5KB
-
MD5
0af3046ee6edfda13b9937e605fb465e
-
SHA1
019bfa006ea2b31e293c4d212012385a47c79be4
-
SHA256
336ef0c1dbcfb6b43e7443c154cdc4f36b7436ec1c370fe49caae080a8df99c5
-
SHA512
ac9d7a442ea7a2b1a96baa3fc2c21ecdcc3bf6427f6f3ccd3e47ac62386e1661a02ca3093c6dc14306260b25d5ac3258b745c80809a902ebaf3dfbf8bfea4134
-
SSDEEP
48:pqNmNyhJgg3YyriumLvt+Z5prqRuYZAoFjAfFi6UFnQB2yr08yWDot9mq4/uR6+B:ADrfmeBWV0BUKB2yo8yWD+9HHB1LL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3020 msedge.exe 3020 msedge.exe 4072 msedge.exe 4072 msedge.exe 2920 msedge.exe 2920 msedge.exe 904 identity_helper.exe 904 identity_helper.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe 4072 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4284 4072 msedge.exe 35 PID 4072 wrote to memory of 4284 4072 msedge.exe 35 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 4220 4072 msedge.exe 79 PID 4072 wrote to memory of 3020 4072 msedge.exe 80 PID 4072 wrote to memory of 3020 4072 msedge.exe 80 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81 PID 4072 wrote to memory of 2908 4072 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd657e3cb8,0x7ffd657e3cc8,0x7ffd657e3cd82⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,6583541394288857284,11393820648687197501,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53b1e59e67b947d63336fe9c8a1a5cebc
SHA15dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA2567fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
SHA5122d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
-
Filesize
152B
MD50e10a8550dceecf34b33a98b85d5fa0b
SHA1357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA2565694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
SHA512fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
-
Filesize
505B
MD54c92d89c7b2f61dcb09408dcd6aa7cbe
SHA1bc66a2d65ec4ce7f654152bbec0e78dabf4916a7
SHA2561fc1e50e9c8051faf16667371d68afe7599dbf52cc41ef30fea9215443955348
SHA512578b6b7bc4e2fd2a3ee078978681b76e2ff9ad3d3a48953c82a1bb9889a74309a5a6c813d91f9d4e72f385d13444cac91317c4088789dc68c6f3af983151c68a
-
Filesize
6KB
MD5fdb57718430a40f1be13d3b4f950387e
SHA1f775e72740c38fa9bf6700342cb9832805de95c5
SHA2560df5f3e70b579eb91bb78a681c502ddf99a74a0ad1ab353349e6396be836eabc
SHA5126f17ca65b411133a6c9b2c89fb41e67201a071317cb9ef629d415ab50e8ca481886109ff4097ba94903d52be1e9c17732b506c756f0a217adc66e7fe19a3a8ff
-
Filesize
6KB
MD5a90ddd3742d342b2b677adc6bd74457b
SHA1c4778d9915470eb57fd2daaae73223a59a230ba2
SHA256120a9a13ae912fd38842fbe9e71d904c8f7e2a90e03e217b6c5b0056a397435d
SHA51278f45c49fafffeda225e5d0d4164885bbf07e1be506d2792cd75b727247db71b439154dc94fa275681251a4c4569e34e3a8306a977178a13ac66293bff456e44
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD511f76622747ec25612bcd90c93c7e77d
SHA11d97aefac199afdc54e5c1ef3c2fd265ba121dc6
SHA256995a4f5813b085a405549eebec5bae1976ce4fb332b3ffd44dde76b24b44ded6
SHA512b4ecc79ce1ca4ae66fd9394389b02184477d367bc3f88e5e7c37b93d8d9d3e60448395015e3e68c1b388505f5f35856e791b19dd77dc7036cd58954db8fa31fe