Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
b5a0ba5c7c9b74caf6fb10f2d27691a2.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5a0ba5c7c9b74caf6fb10f2d27691a2.html
Resource
win10v2004-20240226-en
General
-
Target
b5a0ba5c7c9b74caf6fb10f2d27691a2.html
-
Size
18KB
-
MD5
b5a0ba5c7c9b74caf6fb10f2d27691a2
-
SHA1
c9debdcdb7374db30b715b5875c1423c1e14d951
-
SHA256
4e50a9553be66a8473434cac815bdf0e3d53dd488cb9bfdda48b6e17c3233fd2
-
SHA512
17253b5429d4181193e1ed3d3a9b50bbc3275aece992dc679f02dc66c2ed108b86452001f5e40e1e9d36cda7ff279b8a8f76c12640b08a8bae8e1a90c4191df2
-
SSDEEP
384:OkqFvXy3+kp5SE/u/S9GwqZ3Y8JY8IMFXhP/ctFOnvdrWS/jFf:2K+kp5SE/u/S9GwqZ3Y8JYJWmknvdF/p
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2964 msedge.exe 2964 msedge.exe 1760 msedge.exe 1760 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1760 msedge.exe 1760 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe 1760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 4640 1760 msedge.exe 87 PID 1760 wrote to memory of 4640 1760 msedge.exe 87 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 4336 1760 msedge.exe 88 PID 1760 wrote to memory of 2964 1760 msedge.exe 89 PID 1760 wrote to memory of 2964 1760 msedge.exe 89 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90 PID 1760 wrote to memory of 3672 1760 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b5a0ba5c7c9b74caf6fb10f2d27691a2.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb0da946f8,0x7ffb0da94708,0x7ffb0da947182⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13347572771202183062,2870372093541416852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
6KB
MD5b240e65bf705407ad47aeb8a8692d82e
SHA15f95ca5e31a405233310b633f4704fd72418bd44
SHA2561eda7ec1c927a9adf0c23e9b4028fcbf98e7ebbd2d74fa77ba1356112b693771
SHA5127da2ad57af7f39c158c3fceb1cfe614dadebcd4494f9637a651509ccfb6a26d04f3e84ea07a4e9f2640eb9218f13554fad3f14a890bd566fc8e84b5953a20503
-
Filesize
6KB
MD506d4d7858c1e4e378316bc46fa8ac3ea
SHA155e9aaf193ee0125a6d226902b189cad88c20d76
SHA25668a4a71bf12461d80a4927a2b60e1cfcb19b9ca6b9b7abb3b598e9ed50f23898
SHA5120675954a11df5ad09cf782ea4acee945af5d9377f464a48c05f83c83165c2e37f349b36b96cebe8a4e501e8778c983fb2d965833b65a484fb0631d053e04f6da
-
Filesize
11KB
MD597c7467fe884fa1d7f28dc32c6f91fee
SHA147e156aad485f06305827625692b57722d1b4dd9
SHA2563f0b37288c2b6eadca0ddbf88d0e397413e5ff7e2f9697508e9634c9e9872329
SHA51260539132a7eec9af075e69edab99983af3744d9700260c8e6953567d2fe103f0687796a48abe073e825a7cecd52ba5bcf9098e09215d9d0b578ae72f2d4096c6