Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
c03ebcc47ae0b75385cfa2ab72c84ec1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c03ebcc47ae0b75385cfa2ab72c84ec1.html
Resource
win10v2004-20240226-en
General
-
Target
c03ebcc47ae0b75385cfa2ab72c84ec1.html
-
Size
4KB
-
MD5
c03ebcc47ae0b75385cfa2ab72c84ec1
-
SHA1
3c22d1360da6550be28774c28d4b2b1f156cd963
-
SHA256
6fed809b655d3df1aeeb7bb8a49636c842bbba8792c360deffdf06cc7b36608c
-
SHA512
9e4e7618be1091e9409479431c1cba9580191309bfb557ccea3ab2d768ab2c1b33ff1889b560d8ca8c12a46e5bf14a16bda0fa64269c71ff66e2cbb664c29231
-
SSDEEP
96:iLcNQ3KA2f1fcf/XQtfifof0XNCyflYp0XzoGkfl1f9tfXAoDPQimPf5fMYAmpvs:STNC4hk/DPQDmC7zSPMUPZYE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3200 msedge.exe 3200 msedge.exe 1432 msedge.exe 1432 msedge.exe 1712 identity_helper.exe 1712 identity_helper.exe 5448 msedge.exe 5448 msedge.exe 5448 msedge.exe 5448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe 1432 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2320 1432 msedge.exe 88 PID 1432 wrote to memory of 2320 1432 msedge.exe 88 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3092 1432 msedge.exe 89 PID 1432 wrote to memory of 3200 1432 msedge.exe 90 PID 1432 wrote to memory of 3200 1432 msedge.exe 90 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91 PID 1432 wrote to memory of 4672 1432 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c03ebcc47ae0b75385cfa2ab72c84ec1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe691246f8,0x7ffe69124708,0x7ffe691247182⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:82⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5586676374052799286,4510237564717740517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536bb45cb1262fcfcab1e3e7960784eaa
SHA1ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA2567c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA51202c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
-
Filesize
152B
MD51e3dc6a82a2cb341f7c9feeaf53f466f
SHA1915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA5120a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
-
Filesize
6KB
MD55843088fb118d0b699948d66727e145e
SHA1d93eaa3ac0ea01da60d003c8eb46dcf36d7c88ba
SHA256d1098a4577668af2dce73b37d811f5742eb059052004eae20abf2fea11291ab9
SHA512cfa6bd1130d1d22bc12a3abf616e6a3e58a76fd22730b2e9f6a07654cc9c7c061440fca033e59c122fdfd9dfedfa37901ba7a254088077a121a2c28dd45267d8
-
Filesize
6KB
MD5df21e8d21114879b2cfe95679db2c9e8
SHA1a6576734bc85ab153c7e3007bb7ad6937ab56667
SHA25660fd5ef3c9151555f18f22bd49dccaba9e994271aa5d57342f7afddebbf39697
SHA51202f58308348b7896820f0eb9b5e68107460c028b5b0423510bc899bb914eb010a1b8ef6244361c41ec003b8f97c2a68218329d9a9b6d606ea8187f937f90d3cb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5cca00fffe8a1b6c10c2c11e2143ac15f
SHA1fff52ac5debbb9861b4c3c6a0d270e39d7d3f550
SHA256c9ce9c82f14c4d14775b6803bef51045202ccd42fcb2407734b96235167ae91e
SHA5120008475f20443dca2d059d100aa461f2c27c28c8086997764fbadf0b3c5dc4927d4598c83c3f8239d8c46584d99052ea838bfc855d4220360b020d3f54576947