Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
c4c0f775c0fb8c49b545c4b7a982e34f.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c4c0f775c0fb8c49b545c4b7a982e34f.html
Resource
win10v2004-20240226-en
General
-
Target
c4c0f775c0fb8c49b545c4b7a982e34f.html
-
Size
55KB
-
MD5
c4c0f775c0fb8c49b545c4b7a982e34f
-
SHA1
c305b21fbcc81c4dc8a8176ab4c4aaa233860efc
-
SHA256
100e48de5ac8055d46c29974c670c02d4392c3d05190f7fc41d39f24ec6be5d8
-
SHA512
c70acfdb1e3d696b583cabfd3ccf8e7a162c498a79dfa5ecc9845c22993c6b07602812601a48a39dd8ccb98664cbe5523b1c48542471eadb04f075371a65be08
-
SSDEEP
768:2rS0pHvvCIoo13pyfSBYmnOeWHqlC/sR62D0nA:2+8Hv7oa3prBYmoW62DL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2608 msedge.exe 2608 msedge.exe 2172 msedge.exe 2172 msedge.exe 6140 identity_helper.exe 6140 identity_helper.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe 556 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 992 2172 msedge.exe 87 PID 2172 wrote to memory of 992 2172 msedge.exe 87 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 1916 2172 msedge.exe 89 PID 2172 wrote to memory of 2608 2172 msedge.exe 90 PID 2172 wrote to memory of 2608 2172 msedge.exe 90 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91 PID 2172 wrote to memory of 4060 2172 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c4c0f775c0fb8c49b545c4b7a982e34f.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac72346f8,0x7ffac7234708,0x7ffac72347182⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:22⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:82⤵PID:6124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:5244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,951596788074966877,14767333193395637684,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:556
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5ae02850aaa343c9e4f3866259151ee10
SHA16407c55d3262a69e69874b886606ff8196bf2565
SHA2564c61e7759348549ca18ce2399151bfea5acfb193942a88fd527bc2d51b9028ea
SHA512a95e499165dfd43b5f89c565dc776d373b66f80ddc9fd925e2844afff3df5529ce8143b3061355fe627226f3113a553391903d097357732fad39e50dfe064952
-
Filesize
1KB
MD5c791e7ea42cad76bf88d63a7180e6fbc
SHA1cf80a90b0cde05572e86b81f7996eb5db28009f5
SHA2565f69e98f8f0e598041a5222b74ea398a9812683fd5c3e1b906a39a3dfc348709
SHA512d418ec3b33a4e9eb9d5d0d9a81531e8b03420f001c2030c8f72db29eaefc37e39f32823e929dcd950368bfbdd86251b00554142c214953e0b026b6ce06d29d1a
-
Filesize
6KB
MD5ace1fa2e04e79a2b1c681fb26891ae1d
SHA1cd065b4b31e279ae627bd29cb46af4131335c13c
SHA2560109abeabbed0ca4c7ba39eca7c3eef1b4771a917f8822c169cb703adbc2eab6
SHA5129972cb3b2e300f1c344e7e06264d9ba6c2487caf708e958ae1a3181a89b237ecdd6192cfa1943a96baf047609ef535c5f9d46893b8582242c584a251d49714ab
-
Filesize
6KB
MD5bd5526c93c1ba869386bc31839cd5115
SHA16fa4519f425f713586e1a6f9fbb98748739afe3d
SHA256642c07038702e0c41d2ae8ca750d4dd691e8e2d1811f3aafdd071419802a2922
SHA5128a7212c91a6c3f4ef5ba1ba3a528ac80180fdf116f3a5c4b292ebd3a6821c8b1cc2524f16e2b4ca61ac682d25094d90feb8bc08f49990b35b02ca795ae0de8e5
-
Filesize
6KB
MD5a4c3c1719739a5774f22cb2d44a93f82
SHA18131a8200e9ac30e03f050cbbe1a0db925b7c254
SHA2564cef766537d058e777f2db80c572301dca9d2c23a631291f26259bad0336e3c4
SHA512c2d193970811594c3f2683f1a39135ae6650b27d071e73b07aef604a8e86ea1f29222a34cdce480cac522b8c529528a47b505ca6a65abf668eaefcadc7c98f95
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bac0c195b29ca27081a2c06eece414df
SHA17cd1b55541cd2509f59960a4d36f9092b753180b
SHA256f89f4f9d3963f10dc6485055dda5e462e72e63004a5a534f0c8fd6a7d5425cc2
SHA51212bb69c7e5f244a59e65fd43381ab22de4c814ab9f2ebb09c4536ff9c61c463df29c4c1fa5a8f9cd2131519f119beca35548b3297fdd14600a494edc24228eff