Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
c05bf1f1144ff87d95d1e24fa376cec4.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c05bf1f1144ff87d95d1e24fa376cec4.html
Resource
win10v2004-20240226-en
General
-
Target
c05bf1f1144ff87d95d1e24fa376cec4.html
-
Size
11KB
-
MD5
c05bf1f1144ff87d95d1e24fa376cec4
-
SHA1
4b389b23aff1fc209ce7b719d9f65b68bab716b0
-
SHA256
dbcc984763e1150d02841493cc1e8c37c87118c4242a2118317ae2b19dda4b78
-
SHA512
fdfb10533fba1d967e6a7178d147d95f743320cc3fddb51b4bfd27cbf392cadeb6bf0a5b70ee7400287a7dd951e748db63db32e078369b21a3a40afcaaa32abc
-
SSDEEP
192:XloW0hC5jcrHUYkoXs6wqUtTjMY+8NIALYUXvmor+mASoCgxZKlmP3KTAL3vV:V4ecNXRbU1YY+8NIALYaymus2V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2852 msedge.exe 2852 msedge.exe 1488 msedge.exe 1488 msedge.exe 2028 identity_helper.exe 2028 identity_helper.exe 5908 msedge.exe 5908 msedge.exe 5908 msedge.exe 5908 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2088 1488 msedge.exe 88 PID 1488 wrote to memory of 2088 1488 msedge.exe 88 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 764 1488 msedge.exe 89 PID 1488 wrote to memory of 2852 1488 msedge.exe 90 PID 1488 wrote to memory of 2852 1488 msedge.exe 90 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91 PID 1488 wrote to memory of 2868 1488 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c05bf1f1144ff87d95d1e24fa376cec4.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff967c846f8,0x7ff967c84708,0x7ff967c847182⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:12⤵PID:5136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11351298953802152557,14318374862100601241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5908
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
Filesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67ae5242-d874-4dde-b4b3-426231e1639a.tmp
Filesize6KB
MD53fdd069b44e118c4afe43bccf8cd70fa
SHA1f052cf16c7dcb7380191bead3c3b452155b2b203
SHA256e5df9c6cf7cdd393fed68d1ce1228980b4e719cb8955874129fa7a0d45112d10
SHA51272ee190c1ef60b70284d600935c5ea2728a738792f43c4b6ad58e1e2c8f905876a7b3f4c58ac48e2ac1860d4a8ae258b54bbbd80a4612730421dfbac7b16c224
-
Filesize
194KB
MD5f5b4137b040ec6bd884feee514f7c176
SHA17897677377a9ced759be35a66fdee34b391ab0ff
SHA256845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6
SHA512813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5d0e5f815334600957155f6c14d9fdc79
SHA10cf8603c750fcf8db8700dedb3f0479f0d8e80a6
SHA2565c6e999f9dca30451c17917f783929a4a54084d5b7e53ea387e6b6715554fe41
SHA5121c2210706492d53fab6ec4d6d3af5388dbd4903af259027f7c76199995e6747a5056250370328665ef786eae66d85951176a6fffc961bdb36e82240a9e520b9d
-
Filesize
1KB
MD5a7dc54f32f7f2dfe27a7c3638db7a309
SHA1ee11026fb70ecd7f389d308524b0f66e8ae1f89a
SHA256601c9351b5290572dd7cc526e72b90a212db9bd3b1a63248ba447cdbaeaad068
SHA5121e176606493d0b9f63e9c7329b610d068fdae360e77f42e887c7772fc82ee10a77e5bea08ea8c0c676dbc9c0f16ef424752302369940e0aacdc5a86c675d37b6
-
Filesize
6KB
MD5ec83dca21c50ce66d6b2e623b8f71953
SHA1f96bbc33ba0c69f7c090dbd8746abd1cabb5d53e
SHA256c36b9f41f30fbb5e51618308ab44f32ebea74e43062bdb570d42faf487fe0313
SHA512e6be91a4ad2444332bbd33a9513f760b62c0caf465e3a9ea5b496db86a61aa6b500db2fa19a933fef39fef01ebfd3245bda19ea75836bbf2a5be2605b46bb82e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57f320bd98a6c3dea49eb0657c64a2a63
SHA1bab97f2ccdb77c80435d4fe46b6d730c45bf04fb
SHA256cfe68c456bcdcc3d71ab8804146fe5f8fa481ea9e720e16007063b29f3189d37
SHA51222d4a86bcf5a2f9e59509a6f5924ff8fc81db57d1c026c5721b50ba7404b0843c69c5cf8c8edb70ddf60c6acbda26d17f88e66faac88e589eee1423fc3d20235