Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 16:23

General

  • Target

    a43d186ee483a757a3439f3f642baf22.html

  • Size

    341KB

  • MD5

    a43d186ee483a757a3439f3f642baf22

  • SHA1

    7fbe2f5b6e7aad2e32bc2d8d1fee6ddef29de054

  • SHA256

    04d95a3db480b77a0c97dfdc33621ae39fc7acfa4905f3b4b998d08219187489

  • SHA512

    f26835bd2f689966f26ee9da99ae30437010cb9b316e813fad23d251a89837904668800d9f6c3976b9af343bbb16a3fe20778094896f6408717a1d9aac1242eb

  • SSDEEP

    6144:nKH1zwa4WXstOyhmv5FgrBfPGSudalMNVBaDfgaDiqZdHc5Q1Zg7h/WrcbvQsVB2:+1qmv5FNqZdHc59lWt

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a43d186ee483a757a3439f3f642baf22.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf0a346f8,0x7ffcf0a34708,0x7ffcf0a34718
      2⤵
        PID:3088
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        2⤵
          PID:2472
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:832
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
          2⤵
            PID:3868
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
            2⤵
              PID:1280
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
              2⤵
                PID:1768
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                2⤵
                  PID:5076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
                  2⤵
                    PID:2572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
                    2⤵
                      PID:3520
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
                      2⤵
                        PID:5092
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4204
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
                        2⤵
                          PID:424
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
                          2⤵
                            PID:4656
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                            2⤵
                              PID:2320
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                              2⤵
                                PID:4732
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:756
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4324
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3420

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  d62cefeb0c8fbab806b3b96c7b215c16

                                  SHA1

                                  dc36684019f7ac8a632f5401cc3bedd482526ed7

                                  SHA256

                                  752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

                                  SHA512

                                  9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  7ee1c6757da82ca0a9ae699227f619bc

                                  SHA1

                                  72dcf8262c6400dcbb5228afcb36795ae1b8001f

                                  SHA256

                                  62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

                                  SHA512

                                  dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  408B

                                  MD5

                                  4941bbb9f872e1c817071b4627e9daae

                                  SHA1

                                  ef976e4830dd1f27eadd57f2aafb779540c7e1ae

                                  SHA256

                                  93485f5232a9e6d25783a65ce49b1a28705433690439302448f815719997ffa8

                                  SHA512

                                  bc3f335bd9facf09cab323f80a0d5013838a91db56399c3ac3f0120d3d34c2b1aacbce11edd6586395fb9d401e2ae7b3ba227efc9413e5155502bd53ffddef09

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  858cd61a122964a917f2b52d4527e451

                                  SHA1

                                  c1cd3325d3312720b4aadaa19b43fd8c7a484a07

                                  SHA256

                                  dd904136b5c2dd7c0fd72fa057f7b8be24e75cf6e60844965e1ef2973872bb79

                                  SHA512

                                  445cf62030cccca9ae02c76586fc34cb7fc45f970b12d4ad0f82bb53192caa6593af5f13a9e516df994d3a0a61b9100adca166869b49698f8b230dfefa88a142

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  5d5fcec9fcff32c931a7bd06447847b2

                                  SHA1

                                  066d6c7c0cb99beaa18c24b76bbfbf44d5c6858d

                                  SHA256

                                  191f4eba5c420957df5350a17f7b34422769d6a63ce07c9d9fe7e8bc6810c737

                                  SHA512

                                  8fb03e4e315956d6f09c59d6619b64eb7f7fd9822704ffc45d437265a601138b491a4e31dda27715dc837f6abe3514eb1ae0187bc34ae36b816d98b00abe6746

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  b1656b82fe351ec7f07da51c52700464

                                  SHA1

                                  e18f4c60ea8f5bcf7365d8139ebc9d7dfd9bfb7c

                                  SHA256

                                  e12d143e1755cbceaab6084a07e2ea47d7ba2c986eb361e79d17faf0679651a2

                                  SHA512

                                  68d6a84addfeb9d9c4d90d8ff9b33515f404826bd8290b9af29666c2e11a0b9ee94dfc7cfced11ca1c781f25646311d78d897e64e42d487b6a9ed827787c7222

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  98ca8c787535391fdf72a20bd4351474

                                  SHA1

                                  78a2bba03610165ba7e36eaf3a82106f7106efd2

                                  SHA256

                                  bb97fc5ac5252d8c46698952d556561c0ba836e8b9f0fcafbaf4289a78ca61fb

                                  SHA512

                                  92e67c5965f7f6579c2551d457ca1ff120ac946fbc5dd4d1dff73ff963dbc2ffd2850fbea2f41592afa98d78c31b89f016178511297559ef082b4657bc2054a8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  de370edb1af21259f94ef1d25e785557

                                  SHA1

                                  818ec9a34633048c8960c2c9451c695b64f837a3

                                  SHA256

                                  c0cf65af4fda2f94eb09c331a182c7a1b1599fb2bc119039e46f697a4f4dcd77

                                  SHA512

                                  cc78a88bf7d473d28119185660af3c4905550f31fb829e52fd71b84fff00b71ef6cd3ee0dd50ff9f897e0973019703e483408cf41133d6005244ae724f047861

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  8d51430d60ce5436537f72d60eba3ab3

                                  SHA1

                                  d21ad7a034b7a2a2ee2cad571d60da15d1374dcc

                                  SHA256

                                  4d4a848d5c8e707ae01fc9b85b4cc04ca11f7863476fa15d166287cde669e944

                                  SHA512

                                  40dbf2b38db89c8064d93e9bad8ce4e31da6bc4044886fc8ecec34ab6728cda82d48998252dd775f07b4bfc6fd5f36a1f9cd43b0de26d0ad522f681670d33853

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581008.TMP

                                  Filesize

                                  872B

                                  MD5

                                  d74275891d94085fd665b5c27be6630c

                                  SHA1

                                  45781dfe1cfbad140f0397b7759b4b24a461b750

                                  SHA256

                                  f46d578069bf1d38d2578901d7ceb50c8f8c3f3bf42f339efdd183de8c72a26e

                                  SHA512

                                  2c1cc1d18cb3d715753c93f16c9c0efdc4a1568aadf2f72c6f7a799d11260737ad57782602cad8acee9aa6e4047c7573ef1d55c98c3378e81a5a7c9281bdc7bd

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  c57e5951ba5ac7a6d033fef8b558cf3d

                                  SHA1

                                  360ea3e61d2719d979be01851cc531c578f94050

                                  SHA256

                                  81a7e4d06a0e622e9aa7e2cb52faf9fceff3738c0513546a3d589b7f423dec7c

                                  SHA512

                                  8877dcaf6e26013239a069566a8044b8794851f5ad81a2f2fb41614adcb8fcdeee0ae0d5cf32ad2cb3f1679c51402ea8f4d280e6a3269993ee88c2fbfde87ef0