Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
b5c95f75bb22daf7872f0577d1d21ee3.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5c95f75bb22daf7872f0577d1d21ee3.html
Resource
win10v2004-20240226-en
General
-
Target
b5c95f75bb22daf7872f0577d1d21ee3.html
-
Size
31KB
-
MD5
b5c95f75bb22daf7872f0577d1d21ee3
-
SHA1
f673238b45fe7dfb3a3b23fc391f1dba994409e3
-
SHA256
b503f12952ea7781ebcf16d99d263dd057aa5ad0bdabf0978ca82f549ebf42d8
-
SHA512
a40e7daa0808b803344568ca98afad6a74a72da2eff1460c854de6b5ec537cda8bce5343d3cc435607feb202c46c2251ecc23e932554f1d34b1cf24c2b009f68
-
SSDEEP
768:t57lJOorwcKhs7nsrzJBGAF2E/34LcD4C0yiWht46HQVh7kMCu:PprwcKhs7nsrfGRE/34LcD4C0yiWhtlU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4224 msedge.exe 4224 msedge.exe 3920 msedge.exe 3920 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3920 msedge.exe 3920 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3920 wrote to memory of 960 3920 msedge.exe 88 PID 3920 wrote to memory of 960 3920 msedge.exe 88 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 1400 3920 msedge.exe 89 PID 3920 wrote to memory of 4224 3920 msedge.exe 90 PID 3920 wrote to memory of 4224 3920 msedge.exe 90 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91 PID 3920 wrote to memory of 3692 3920 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b5c95f75bb22daf7872f0577d1d21ee3.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa84c246f8,0x7ffa84c24708,0x7ffa84c247182⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8305356272755800548,9511659216099908390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:556
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4252
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD509c5bb4d26275f0745fb470dadf29434
SHA11990fc99f8c6c49321291f77e4377d339bbf0049
SHA2562d2f76adc4888dd21e03990d5cf8fa5fcf8c35a7a1c8e5e3e346e5f867a8a18c
SHA5128e724d725d74be3fb5abcdaaa74e769e4a1bfdd102a57d3c0d5deb062dd7804b25286b3ccca48a2c09fdb77be564aec0d6f63a3e8f9648b63b6ff86b84a20738
-
Filesize
6KB
MD5bace974d8e0477854a5fa4da05634627
SHA17a0b306a08bb92b66bf5c33bed79f5550a3238fc
SHA25638dc2f3f09ec856da70c46db5df02b9fcbf23066db5a68dd650be2ad28b14a00
SHA512950c21447193d29114c0bfb789053ee4d9328f98d2b30e5627fda01ab9b1fdec061a80e0ba7667d6f2c4d2d8a791875f011cb9a14b64726ae5c13e0ad31c4bd8
-
Filesize
11KB
MD58cc55ef1b0fe85f1d736b52d923f9cfe
SHA1ebcabaaa4eba5a0909f44850f00a2a7542c664a4
SHA256e50e7c8f9a096a2f4c45e0b0f82bb55fe6ae8ba7d4be0be6174c3b56fcc60296
SHA51293c924731a5bcb3a70938d670b60ac4506b1c443c5d52487e8249082f1a0497203116f80f7e926c2b68c394b663d6b68d3702c65c2c43406dedb960d7b2e3e18