Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
a (2).htm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a (2).htm
Resource
win10v2004-20240226-en
General
-
Target
a (2).htm
-
Size
1KB
-
MD5
fa29916f652602f11362858fc58ee874
-
SHA1
3e79b7c48adf7dbe39c935633d442d4826730344
-
SHA256
923ae78ef3ace374cf0d3674376943b0cdf1747b46de74dc5c14fda16df936fa
-
SHA512
902f2b5c73920a4610f898804cc53592de6bc62979ee092b0c15121cfd632c1c1b1d85ddaa3e2275d7e652fbb0a6f7d977f77456f1fcbbd3007861ed49781d6b
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 3684 msedge.exe 3684 msedge.exe 2004 identity_helper.exe 2004 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 2612 3684 msedge.exe 88 PID 3684 wrote to memory of 2612 3684 msedge.exe 88 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 1636 3684 msedge.exe 89 PID 3684 wrote to memory of 3316 3684 msedge.exe 90 PID 3684 wrote to memory of 3316 3684 msedge.exe 90 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91 PID 3684 wrote to memory of 4956 3684 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a (2).htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf6df46f8,0x7ffdf6df4708,0x7ffdf6df47182⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,9413742609395063642,3581969495462421101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:3260
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD546cad312b99e08e4ede343209f19e839
SHA105a8a17dd1df64e711b7d1d712faa59e35e3d5b3
SHA256504b05ea2003c55ea0cc31d357d3e9bb28c6a73f2acb1890bc5fe554ece384b1
SHA5120b494aaa15d24fb206b7915d8d946dce73c1cbf01da0836dcfc08a00ed902891029229ad7585e3436f5c0d2811c542fd4f6a2bb6c8d487fc0703c835fc5a4853
-
Filesize
152B
MD57740a919423ddc469647f8fdd981324d
SHA1c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA256bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
SHA5127ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
-
Filesize
152B
MD59f44d6f922f830d04d7463189045a5a3
SHA12e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA2560ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
SHA5127c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD5052cbe6d51a879b4324c0698550e9856
SHA1fcd84cc869bf126af8bd24ab0da32c3cabf21ce6
SHA2562d0d8aec3f1ab6d61b84566073141275df4ce7e63ac43dbbc15aa3bc2f778018
SHA512aa2343a07024c1408d052190e8731022088f7a5e0972b3725eaaefa52a475e744e18ccb46bda065feb4581b905211225ef539b7f93b495c0c4e34efd5c2090f4
-
Filesize
411B
MD534a7879c8fa787b817fad6972a57841d
SHA1e05991cb9ddfa006d8d15d5efb1ed0a414df5886
SHA2561094cfe5e6675cc71a48f8bdf2331d230d49cd09b8bd45372276c72e7ef06626
SHA512a96929ef00cc39be255d7ce21e6cd5f78374c7c1d9abf5969645a26875698e6ee8fe6c10ffc92ffa7df721c5d0ea38766f1871b63c825024cce0c87808cf6713
-
Filesize
6KB
MD555403d1d48b024e00b81d5d4cb788588
SHA133201b9744637f818b60dd67186db758f33a9b74
SHA2566145ff004ba028298348667847d29279068a03f8e62414482c106781768d352c
SHA5129ca79bbbcb1763807e53c1ffa27b54104d6720c1c3c9963bb7adc3339b43f02b537b742ea10f217fa4b0934c28594436eb6541f199cda6a3765462d5806a5379
-
Filesize
6KB
MD56617a66c9148cda6d84c7f37184b3686
SHA143aba7efd3e07474120245f373ee64a4734b50ea
SHA2568a402d3233bd7b691d09d3db616974e6940c7e4964656bfe7db088497d2037d6
SHA512478834f2cbc4e3f1cec133cb2a98dc5f84b9fa759189e3e432213bea107ce9bbfab4d78f2582dfc970f433b4a7ed10ace7a0f078dd4a8a20ba6ab40d3e568baa
-
Filesize
872B
MD524bcf6df83fb2698436661f4954d4ab7
SHA169fa36d03bb711c804c0af09c1f52af86bfdaa24
SHA256d64f020f03839445753de74700c5f18d23167fadc323d8b0ee01f0fe021bdcfc
SHA512c6a7cd138a990da8f2a3670d37d6f588e24b6b6497f10ea7af2be37bc9e639814b7c1e712726a90c0e92b96b7ecb012af92b82edf80ef47ff28ffdc5b8536090
-
Filesize
872B
MD57404b2dafa7b87767da11fb624a7610d
SHA1cc811e811857a238a2e6c7085e27b0d3fcdd3823
SHA256148db913404e6fec468b453066f56f1eceaa7ac57280686beec294541a6cae1c
SHA5127af723ca75380e8a4a8ecbbd3a508eb7664744871a2a54c6c6667b6324656af6a67a3f2f55bd2c0165bc3c1a6fafcd000af918be174e0abbb081b7fd13949b98
-
Filesize
872B
MD59bcd00940ad976c2810ef01a71f592b6
SHA1ccbd044edd1dcaf5c1b99c3e63a2c31d2bdf727b
SHA256f1e21bfc046b43dc18ee913608228e15662a3befc458ae64c86acf7fd1063a4a
SHA512b2fc868c5cad722a2ea0490b013fb23f290ac94a4b378936a72acfb5a949b35b3d8d31934db9f8927e50229f913bef2ddff3aa179265b5e0a69d98a2a4bea781
-
Filesize
872B
MD5fa77f9b8bf598f3f0ddee798b080633b
SHA1b5d27d8a0938d65b0b9fffde77804b3525fab70c
SHA256659e343f89ab14573887bee439f0c6ea53b34e1177d87a0f409bcc535614c7f9
SHA51224a05935287b48107850a67d9609cf19ff5fa830d2d2bfbad0919aa71841fba30d8596ee0415fd222765ba31ee14582e4a1bc251536f6bf6904eb377f07f15e4
-
Filesize
705B
MD5d9bc5a65fad2484106618e8ae876c16a
SHA1aa015186287bb1e081e66ece7f2c05615fd09836
SHA256de3e02ff0d8603b3557020dceeeae392fbb761c969e7f85809c752d01b728533
SHA512343c2543d4be0a929ad791deea3313b9f655800ed1e984d3d36e58b6e2ba42486e32be97748d5f93da97072d529817408a1ed3dce0a60bedb1d535fafc5a8cb6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389