Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
bb0e0fc699253a3fe4decffc46957e6d.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bb0e0fc699253a3fe4decffc46957e6d.html
Resource
win10v2004-20240226-en
General
-
Target
bb0e0fc699253a3fe4decffc46957e6d.html
-
Size
964B
-
MD5
bb0e0fc699253a3fe4decffc46957e6d
-
SHA1
6466fd5a6a46f7b7286b5051a199510600091316
-
SHA256
edc4b321e09d753f8d35b6af9b68eb86ac31fb081d6cf3315bd12f0eb6dd7e87
-
SHA512
26231920af17f01f55145d387829af8edcc574e7c292c6d21bea35625e5fd0d0c00ab5a54adb351782b408cd931de46075e69669b214e55c54704eed95b15226
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2532 msedge.exe 2532 msedge.exe 3796 msedge.exe 3796 msedge.exe 3268 identity_helper.exe 3268 identity_helper.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3796 wrote to memory of 3912 3796 msedge.exe 87 PID 3796 wrote to memory of 3912 3796 msedge.exe 87 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 3124 3796 msedge.exe 88 PID 3796 wrote to memory of 2532 3796 msedge.exe 89 PID 3796 wrote to memory of 2532 3796 msedge.exe 89 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90 PID 3796 wrote to memory of 2712 3796 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bb0e0fc699253a3fe4decffc46957e6d.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff9436246f8,0x7ff943624708,0x7ff9436247182⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12291680111189125811,4388496069753031059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
6KB
MD55091cbeb12bbde56d7e02b7781a61259
SHA1f81808d5d46e4fdcbda43108271e0707fff5a755
SHA256366c8505c374092a2286b814edb7c9d30bbbc64baf005daf5b9d0b0c28da1aff
SHA51287a4ac1f44ae6d76673faedae0186368e8aafb3efee4471d74383e7c02b39a7608c14f759d6f0c87484809f943f45f9940b0548d0136b41c5a86d446cafbab8b
-
Filesize
6KB
MD574060aa35047ed701b3111dd41c3955c
SHA1eba3f1357407d2e8d7f8a09368cc59d49ae7fbe5
SHA256cdb0ac27e20b84ae1106e7a6143b84e4bb4113aeecc21e038306b43a4e3e7b3c
SHA512bd38f2f25fd9c08f21e5c6dd2d0cbf53dbac521ddf035c34196d20503b4996af9f9a944e48e45354545c3934eacd47c00dd3b276523f90091da0a91cf29de720
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5fb6c2c2187bbb9842ec35fb531759b16
SHA1231f96c5ee75bdf8e4aa604fb67fd3361347013d
SHA256a973add67be99a03faef6b921cdba916fed284ef6c62072c0d03428c411dcd1c
SHA512bd4b6f5eb15196c603c9dd3f198db0bddcd4b4dedc538a8091ab85289a0c9c9e60a236f3889086ef213ba6e254f0af4ac4df791286a7474733320bb438624ca3