Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
c59726b67a171a3b6c605ab2c57b62f4.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c59726b67a171a3b6c605ab2c57b62f4.html
Resource
win10v2004-20240226-en
General
-
Target
c59726b67a171a3b6c605ab2c57b62f4.html
-
Size
147KB
-
MD5
c59726b67a171a3b6c605ab2c57b62f4
-
SHA1
b00f0207da2ef09536a2adb3198ced228cb3d2ce
-
SHA256
87a82758bd4b00a3ee8271ca8a872a9d74a4df39bfd75d78b743871f5b30aa18
-
SHA512
1238f3217f81c587f6e285a7622275b03af08558fadd86f927fa90498a111fd463b54f2db2daa8d69c8e963631e9fd692b66672d8984c2557883264960779ac6
-
SSDEEP
768:wq/P2T6nXr3D+1KzWz8i77wDDvj5AbSCKXg7UxW9yeycUi+LiFJd/cQtU86:jmOXWEL27Jd/cQtUz
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4040 msedge.exe 4040 msedge.exe 4860 msedge.exe 4860 msedge.exe 488 identity_helper.exe 488 identity_helper.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4760 4860 msedge.exe 88 PID 4860 wrote to memory of 4760 4860 msedge.exe 88 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4484 4860 msedge.exe 89 PID 4860 wrote to memory of 4040 4860 msedge.exe 90 PID 4860 wrote to memory of 4040 4860 msedge.exe 90 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91 PID 4860 wrote to memory of 4568 4860 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c59726b67a171a3b6c605ab2c57b62f4.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff3d2d46f8,0x7fff3d2d4708,0x7fff3d2d47182⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8939305649496650224,12033372403823917460,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
188B
MD59e60751db3c2c5b6a54f6cb18f9a387e
SHA1c3815742501bd3eb5456958d253c57fa48f14451
SHA256376006f8fffee91ede6e6367fc46a81ad97568e59ede6bfdc1aba6420294d6d1
SHA512e25d565bc4a56dcdb10bb2eb9daf4b031746652cfa55658f35331bc72b0dce59861fbb0a3923857a0382e1b0ef6f38022b13f34e84133567f37872738b12aa96
-
Filesize
6KB
MD5c7c77dba806809cf73022751d2124f64
SHA130f75f0ca75eaaa20ec1872f07f95f48129ec9e9
SHA2565200d1dfca3e6504b47975b79fc07abe6c2e1f18f1e0eaa009f29de3c7718008
SHA5123c9640d69a29b1098a9d7ef27350e7f1a48115417e53664b53799d74cec50c476e8b0f9f8c462b439094ec193c7715b0a0830931fdd30c7e45716d561c933501
-
Filesize
6KB
MD5eded35ffa38afa9f0f2f8f09f854c644
SHA19f37d7fa4e6f5407dca919f932d14e77b7561168
SHA2564a60787bd15641840144a2eb40a1a3ee9e5b7453e2e0ae825ea1981dbc2b20a4
SHA5120260bd8a46b6dca8f9b3ad9b9586da3ae0639e740ba3ac4c8504a41f4279d675f1584bfa954b41733d44deaa80485058a070aa5fa7d044907c94330e1e6d57b0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD54e6a9dbf18df4571a4238563f73bc3bc
SHA16c0db131a7cb9eb6297cdf6f6154d9632f9b2d12
SHA256ac6fcf19d82b12fbe751cde5bfb99021f1a45ab3238c89ad4987a06c7f366168
SHA512ebb38c00dd02f9e66c3eebc0daab727021d89108120f7afb6e401b37092558dbdcd4c1a40407c51d63e4ea6d905e7f70b77be2f8d6d4af990c2a2a59f93e1256