Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
c700546f652cfd5ae81fde608022697c.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c700546f652cfd5ae81fde608022697c.html
Resource
win10v2004-20240226-en
General
-
Target
c700546f652cfd5ae81fde608022697c.html
-
Size
56KB
-
MD5
c700546f652cfd5ae81fde608022697c
-
SHA1
575a94ca662ba28a39d4111a88d46fbc8e913750
-
SHA256
069e125a91a54eb2d888cf651ddfe961f3140067f5eac6b24369cbda5514a98a
-
SHA512
a31c89b6a0c0388f5b13e0ad8f3a702126dbb8429b709bbaebad1f1cccbd9a6fd131bd4d298c377403c5fe90a880552eac80b99de0403806c23da134370a9d4a
-
SSDEEP
768:zLPVpHvvCIoohgxlsk3ik2RVWMwqK2KqIM5hzURh8TtZB/:zbHv7oOgxlF392RVhKdqIEhyh8TF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 624 msedge.exe 624 msedge.exe 5604 identity_helper.exe 5604 identity_helper.exe 5756 msedge.exe 5756 msedge.exe 5756 msedge.exe 5756 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 2028 624 msedge.exe 89 PID 624 wrote to memory of 2028 624 msedge.exe 89 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 1720 624 msedge.exe 90 PID 624 wrote to memory of 2976 624 msedge.exe 91 PID 624 wrote to memory of 2976 624 msedge.exe 91 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92 PID 624 wrote to memory of 2796 624 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c700546f652cfd5ae81fde608022697c.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf27e46f8,0x7ffdf27e4708,0x7ffdf27e47182⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:5688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:12⤵PID:5884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18029237781169963999,106822157654900814,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5756
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD555fc993b78930b6a5a8266800351da64
SHA1a78217c77af1878a0377ce84a80d4e9e9d8e8f55
SHA2565378a4d83a49e20550382614d0b35d6c3910ff8499a8091d9ddcec8369407712
SHA512ed2eb6b260ee985882a9c4348b864d61e4da11faca4949831d0783bab3dbb9778af76795871ca0485d46415263ccdfb7d521f8fe4d416cec3cb52753eb4158a4
-
Filesize
1KB
MD5f3fe813339641f3b813122472d167917
SHA1a680f54b42b003e3bf4a417817d77fa4e766540b
SHA25610cf3282cb16c9250f2067d48ba859da9232e2239ed398774fa16ad7dc311360
SHA512828bb2dcd2c3c5c1f203227c7e375d738c7c1c851b143d5a1c94f272f1240d24aa37eed6a3cb119ec3cd7bd622e224c3d69cd9f4a8362502c0b7448289363422
-
Filesize
6KB
MD55af89f0b20b7832efbe55bc3ddf2db8b
SHA18cfaeb7d5acd07f78255d5aebd774bcb6597ad32
SHA256135b18100dbe5059f82b165582083bb3fd2512622e7004a85e87a47af3fab993
SHA512c9d27e93dc73df8206a26ee813780900ceac7f04b5849f9858b935f6a66a138d5b196aa94c29825fbadec12164da22b68b9a465d0622e5dd217e63b744d82946
-
Filesize
6KB
MD5601eb62473235f31e87411fa3eece1ca
SHA1d62fabbeb59a71a67193291a36d49fe80e10cabc
SHA256c8eeba95a216bd940d365bb176713ebc80d883d080bcd34d7d563e8afabd8187
SHA512bfc0a915cf51979a01c6bd0eb7181efbf4502603696708d88419d75910afeac837cdfb8ea1b050dc155982abf30adc59ba9fa75f93bf7ae2d179a81c482f588a
-
Filesize
6KB
MD57593c93522d90f6837644496e746bb0d
SHA1da7cfedd5bfe63344512970bc3b3cfea244fa71f
SHA256cd65d04f83cd309ee629ba07717ef7b4ab75a1ffe5f968e3e4f398c278861536
SHA512e18b1dc833272a3353320eaa7b9ef812ab58d00d22269fcde95c2de2f40a4544d006b27788fc1a6383edf81839b1a3b478755fea507013e733d68d31cd1d3a55
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5dad052835b8bf45c03a45d1ef7f95995
SHA1f45336fb1d5f9cfe39c68d5778159abec1f7f015
SHA256e16e44ae7293997447313638ab61f11b1db52cb3f0efca85df2f36492f5049d6
SHA5127170b2f5c8362992dd3aee766c1495ea8dac3e4cbd45699ece28b8cbb5c2b70b3ee4d48e6c4357bbe294e024837731d2ceb943c858f5c164e875b89330c0f5de