Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
20KB
-
MD5
13f345776d5400575d84938a2cd9a454
-
SHA1
ec56bf755e1440fce6d391a8ef654dd1a6fbc4d3
-
SHA256
eb699068f7d9f1957d273ea118e7a493e76ec0eb56e4a4eb82180a82416f847f
-
SHA512
3e057c31ee90be2e0753d297c928386a716ef52032561f7f65204e0b42b4059673b6655817a1c548f61f45ba6ba8b1b35f817d7284b6e41e401c8d3322cf656e
-
SSDEEP
384:USFpvs3udMChlFrBiTBX7v+43X/1RFTvMotdvu3hl:Uo9WkhlFrBiTBX7v+43lM+dvahl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4400 msedge.exe 4400 msedge.exe 3884 msedge.exe 3884 msedge.exe 3872 identity_helper.exe 3872 identity_helper.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3884 wrote to memory of 2672 3884 msedge.exe 90 PID 3884 wrote to memory of 2672 3884 msedge.exe 90 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 1144 3884 msedge.exe 91 PID 3884 wrote to memory of 4400 3884 msedge.exe 92 PID 3884 wrote to memory of 4400 3884 msedge.exe 92 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93 PID 3884 wrote to memory of 4864 3884 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc697146f8,0x7ffc69714708,0x7ffc697147182⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:82⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14456279124506642951,8234833487131779685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893B
MD5d4ae187b4574036c2d76b6df8a8c1a30
SHA1b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA5121f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Filesize252B
MD52d0ff334103d161bafe8c9a0a38345c6
SHA19db504a3aec660870ba88ea77773fb45315066c9
SHA25659339e4679b3a7c6cad692be7b560e524f0356783151cd9dc73701e17cd6f296
SHA5123a34984ac116ad19d3eed1be532fec06c7df4d1c806f70c230d3912077b7402953f47eea8a4f5e0d599afb0a44b0098de7e594eb16526fd6960727db34b79339
-
Filesize
152B
MD573c8d54f775a1b870efd00cb75baf547
SHA133024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA2561ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
-
Filesize
152B
MD54b206e54d55dcb61072236144d1f90f8
SHA1c2600831112447369e5b557e249f86611b05287d
SHA25687bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
-
Filesize
317B
MD56b1a359f5253ba9d250368f19dbbe96c
SHA1544fbf447340ebf75965223479a68fc29e9ddd2f
SHA2562d0c06e7283a7fabbf919f2c687828eed1ed31c3546e8b0f180250d041d0aff6
SHA512abf4cc2b07abf2f239ce3e2db8a4b6b33c5a4d8eedc5532aeee1076c7371e44784638acbb09d26d4cd29038db8cae4568b227259218cc5e8a164e7fb9c0f3a7b
-
Filesize
6KB
MD55c7f738dde2b56c2f820f2d547c37fd2
SHA192f30352c6004757300da1e459a7161c73884bd3
SHA2563c24b3af855e9bdde6b07ee1741f24eff4e8c581a779adde6a222d8803b54834
SHA512a055e94b88a853e33718c577351a9c87a79ab9c18719f296e500b27eca097e611b6928dddcf76a5a48f825294e4538994afd2a4e32d073e7956e484ec01224f3
-
Filesize
6KB
MD523c919f28ec9a97ef8440a3d1959a6d6
SHA1b699c090c6d7fa99d3c5d3480f9b86d55d02a3d5
SHA256001aeeb403c8db64f7aa7cd86fc885947ce735974b8aa0bfb6ce06f923d8d8e8
SHA5127bfcc6f6aa305f72ed559b8ef729c20bcbe06e25517526e80fac055e72b01d37f46378479de30cfaf482695094bcdecf9d0374bcc70a3d3bc59145c3829dbf95
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD512c62c32ce41748806c1b2a501f71d48
SHA10c07d3174c822a6c0c3f42bdd3cfa6bd5ab3ad49
SHA25611ef2a43a0e3ef37d9e9fd26c1b8114c7d41387b110e60ecad4e9d2d8bdffa98
SHA5128fd2c4c9b2099ef105e2698c1389c168eb08066f45eb749ad4ebb6908b9a8a3880d742246046f07b675bbe70439449c250b4331811f318c140d282636046f176