Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
c63fbe33a45daec95fa80b7a7de19ccf.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c63fbe33a45daec95fa80b7a7de19ccf.html
Resource
win10v2004-20240226-en
General
-
Target
c63fbe33a45daec95fa80b7a7de19ccf.html
-
Size
3.5MB
-
MD5
c63fbe33a45daec95fa80b7a7de19ccf
-
SHA1
9c8e92c115a2e121a0473ff1f5517423a7b1b29a
-
SHA256
7efac242dea4c90048e2467d3d7129c440dd880beb467aa5482b9e4927e85ed5
-
SHA512
5d1d1bce9af13a6af7d7356b84ff78aea99bb9320c2101efc0bc01000098b5e627263ee06836820a73716375bd94354ffb661bba47f2de50018918d55723d680
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NSy:jvpjte4tT64y
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4676 msedge.exe 4676 msedge.exe 4964 msedge.exe 4964 msedge.exe 2672 identity_helper.exe 2672 identity_helper.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4008 4964 msedge.exe 90 PID 4964 wrote to memory of 4008 4964 msedge.exe 90 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4568 4964 msedge.exe 91 PID 4964 wrote to memory of 4676 4964 msedge.exe 92 PID 4964 wrote to memory of 4676 4964 msedge.exe 92 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93 PID 4964 wrote to memory of 2436 4964 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c63fbe33a45daec95fa80b7a7de19ccf.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3cb946f8,0x7fff3cb94708,0x7fff3cb947182⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5925269543700067497,14052426499848848129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
981B
MD5a473d167e9e18fed5817f72c013ddb46
SHA19d431da69d6a05946b552fe1f6289e94070facfc
SHA256f2b2697609b2b2587ee3d727f404d6ad7332d191e0b350c924955d1110b4c9eb
SHA5123192b574faa2d752ce5519a447647a685c7f621d58743693fd706c5c8ea0d6e3346204b5baac5f6a91fd485067a40663db6770a1715d81c15dd9b345f8f795b4
-
Filesize
6KB
MD52c59ed61fc87853dc4698e93da5249f2
SHA16697bc9903619781f799d06ee06c1ed896f6732a
SHA256c1afdc8361c5b90b4c270fa4d81172abfc2ca1ff0bbc4b099e2b8326605a74c5
SHA5128c66dbfde945949f72c271ee52d12f2b02f5342b4945929cfbab3cebd3468537c7073a0542c8f5a454c7e00c59c4eda795c7ccc54973d54b542bc6ca41081997
-
Filesize
6KB
MD5d6fe4cbac931b429da09c7678997c4f5
SHA1e75858694ab0638bb69b46b191f04fc60cb3d79c
SHA2564b7628e5c143531057c2c8264a8d272c184989b364f811fac8b1df7bafcc8b89
SHA512b89f648066bf1ad3d3def7f8d1a32d590600999e40f5a7b639df32d577a3f44d1e7ff7404e544ed29f116ada016378356d8cccd2ca27d30898779337102f1c12
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52ee9673959d7b1c8d288773cbeafd336
SHA180b251edb7b19c627ed2a6cdb22877e5fdab028d
SHA256bdad251ed8ea966ca52d09e7bd7dc2c8b05eb1182366a9fa2f383c2e9a48f7d9
SHA51202b719711779191b6a2fecb94a3f564808c8a9b9f5c4dec52b4e70e83cc98bbe708502aacf01c6fb08abf7a694d12c9631972f9dc6a8f1f41ce923dfc3b6d329