Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
c2ae1ec731bfbb6b0ee06a75961c230c.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c2ae1ec731bfbb6b0ee06a75961c230c.html
Resource
win10v2004-20240226-en
General
-
Target
c2ae1ec731bfbb6b0ee06a75961c230c.html
-
Size
7KB
-
MD5
c2ae1ec731bfbb6b0ee06a75961c230c
-
SHA1
1c6230eb488e8420da7033cb5859a9bfcda7ad86
-
SHA256
63efa0de3e938393f23b08dd967f0e525a44f26f4af5f4649b4f54a9c730e016
-
SHA512
ba12862f704888f26303048a9389ab222382d99e379b25d6a07dd02d3d39942e17b3239b0055f1e47b8f47892e86b5370a9e64a61bc35ebf231775ddd3b9fcf3
-
SSDEEP
96:4zWvP+YzY4ggpMmNTrj4Vj3ViEZIwLN0uumtnkR39oz/jRvg:4q3ptJNoTViIhuLQXRvg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3648 msedge.exe 3648 msedge.exe 2308 msedge.exe 2308 msedge.exe 5048 identity_helper.exe 5048 identity_helper.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 4212 2308 msedge.exe 89 PID 2308 wrote to memory of 4212 2308 msedge.exe 89 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 1212 2308 msedge.exe 90 PID 2308 wrote to memory of 3648 2308 msedge.exe 91 PID 2308 wrote to memory of 3648 2308 msedge.exe 91 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92 PID 2308 wrote to memory of 3076 2308 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2ae1ec731bfbb6b0ee06a75961c230c.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc78d746f8,0x7ffc78d74708,0x7ffc78d747182⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,7573638896161576916,13326622889360617304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3752 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4796
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
Filesize
6KB
MD52b2806779d0c758255fc47095843cb7e
SHA1e308fc36d5da13eff00594d4e15add1ae7f5a0bb
SHA256ab456779c7298ee44d0f9dde95bc1903751909fc4531fdfd98435d9d26102a40
SHA51270e1243329c0421bb8ea19c98ffb73d44cb836a2594688f41e8fb458ebb11b5b08e8522e6cbc476be8e9c05d5e2f4105976adc41bd8397e381649b21effb6c4a
-
Filesize
6KB
MD5f040fbd21b15eb56f670a3cb69346dc9
SHA19111f06ba6db20d1ddf67fb3bf6d061f714ed816
SHA256ccbb88d88d7f5c0223d5376c110e7c88482bba54406377462120ff93d115fc0c
SHA512b96881a045371bd3a662fa9c18a0e2236d23488d552ab567d94f5d3a639576c8bd6c67899850baca3849d3b88d450de75a7bd894615eb2202b92d7c7c38d1d6d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f87bf83595945e5d905880377f4cf156
SHA1172a39aaf42e4d9ad5464a502cf24b9037cef597
SHA2563248d682b2b55602a602403ec42ef4fbc96e09aeab234a141dd7e3f8b71779b0
SHA512015b8f27fd1413072f408b09d263c194036772114199e0917a706ee641868be60e3d235b4a025a738b6e83e0bb62712337155c7b5da677941a7083bba2b97763