Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
c83052ad1d462f9976424d5d3999e112.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c83052ad1d462f9976424d5d3999e112.html
Resource
win10v2004-20240226-en
General
-
Target
c83052ad1d462f9976424d5d3999e112.html
-
Size
2KB
-
MD5
c83052ad1d462f9976424d5d3999e112
-
SHA1
21294b9c7c3a54bb35c71002a32361f627fadd7d
-
SHA256
ac361aa2c3e44cbcbb5330f9ca0b91e410d7aced4380b66f23617d835fd57cde
-
SHA512
794a5896831984bfb4e514b45d79a4010359e41d6066a2768bcd0b37dd6f5f44bdae74ebfb8730459dfddbe09acbac838e5c50d13bd81c12cef947b1a9964285
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1372 msedge.exe 1372 msedge.exe 2268 msedge.exe 2268 msedge.exe 1184 identity_helper.exe 1184 identity_helper.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3284 2268 msedge.exe 90 PID 2268 wrote to memory of 3284 2268 msedge.exe 90 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1700 2268 msedge.exe 92 PID 2268 wrote to memory of 1372 2268 msedge.exe 93 PID 2268 wrote to memory of 1372 2268 msedge.exe 93 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94 PID 2268 wrote to memory of 1692 2268 msedge.exe 94
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c83052ad1d462f9976424d5d3999e112.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaad6146f8,0x7ffaad614708,0x7ffaad6147182⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7863727104951497240,2756578007885488474,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57740a919423ddc469647f8fdd981324d
SHA1c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA256bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
SHA5127ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
-
Filesize
152B
MD59f44d6f922f830d04d7463189045a5a3
SHA12e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA2560ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
SHA5127c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
-
Filesize
6KB
MD5cafc0fab7cb40bfa64f685c0f3de37e4
SHA1f0e7a7507e12178fd06b78cc2ca2e4571ac131c0
SHA256bd2e11f8e60fc0a04107be7207a2dbc02f15e317cd6c7dce6cb3ca73a813be12
SHA512647018d459065a143d171aec9500f8e657f56121624a91751e2239025c6e9f1a804186cbd1108bce4496c3defa3cf0ba32982a62619881dd4bf46fe8f25b684c
-
Filesize
6KB
MD5d9563bfa77c8949c687955748b4d7db6
SHA11944937b047bf024d7b23a88bea41324ec0f3048
SHA256eee78c32f656d54c0bd1388563bdf089e16713f77e474d93b2b462db7c2a3724
SHA5125a97de9173abd82f126f6a2381be5a2c3228b96cd296c72ae00791a4c7e576db5b51ec0a0b30593dedc54721a24defb8ce09259fa4f3aae53fd65820936566b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD547189698af55e7cd1031359cfb77d18e
SHA162f3da8b72c030a43ecf3de45d3a8242f72c30b7
SHA256fc8e5421814d61b8415e49b625591eb08a0550f64ac9422e0044119feb24533c
SHA512b02c48db3ede35751b0ba691f4aad10a75e27de52101a204cb8fbe2a62d733a9e9a67a37db4c3d37e768e258f6b847a69baf57f3b6095b54ca3ee52cd3da165f