Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
ca4a122b549328a2620e786f2cd66b06.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca4a122b549328a2620e786f2cd66b06.html
Resource
win10v2004-20240226-en
General
-
Target
ca4a122b549328a2620e786f2cd66b06.html
-
Size
115KB
-
MD5
ca4a122b549328a2620e786f2cd66b06
-
SHA1
fc97bad350f3bc5490d2deff408902e76032d8e6
-
SHA256
791e67e8611f935e5e1a3e94f78817c563f36d8290d77c3b957445796e404daa
-
SHA512
fd485dd3f43b5be98ba2d81fc4761e2f624abd5b24e003bafb26e3a82a4c7d6d15a823e3b032e0979982f7796ee9640e0512784390c3a93df8fccc4237ea1f86
-
SSDEEP
1536:S1cyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SKyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 3384 msedge.exe 3384 msedge.exe 4180 identity_helper.exe 4180 identity_helper.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3384 wrote to memory of 4840 3384 msedge.exe 87 PID 3384 wrote to memory of 4840 3384 msedge.exe 87 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 2224 3384 msedge.exe 88 PID 3384 wrote to memory of 1668 3384 msedge.exe 89 PID 3384 wrote to memory of 1668 3384 msedge.exe 89 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90 PID 3384 wrote to memory of 1152 3384 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ca4a122b549328a2620e786f2cd66b06.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbd9146f8,0x7ffbbd914708,0x7ffbbd9147182⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,14987415764150828381,16028796468841534487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2072
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536bb45cb1262fcfcab1e3e7960784eaa
SHA1ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA2567c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA51202c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
-
Filesize
152B
MD51e3dc6a82a2cb341f7c9feeaf53f466f
SHA1915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA5120a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
-
Filesize
6KB
MD5e2a6f2506234ea57fd9d132d19e7acd7
SHA1042942029f70e5c1ea4bd53f823685dae4ba4f9c
SHA2563b96944d969efd27a609a3afb1ec55159d0d1ed34affa90d91ff5d3b8ce672d8
SHA51241576f9b02a5d6ddbb97e464ba2d254a0d629c6b49df95d50aa0573a9923fae9f167e15e50c16b733cf5236794e6d39bfa4b6c5201ee99cae9bca3a99098d540
-
Filesize
6KB
MD56dc935eef4cf0a726b90bacc9dcad7cc
SHA1e2eaac4493f25971c5abacca07aa1a55a4cf1eed
SHA2567cf054f658b9601844d7c8ecbaf711b5211e6a00bb0c050b6cb130faa548dfa7
SHA512294bf8744b122be0d1078d2f8686dd64de477b8cb198180777ef2c2f787ab8a7877d64a7590fc86f06ff9b2da65706714c6a07c13730c823ddf35285100285b7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5576ef30499c09c93d2573af047c5245a
SHA16f4da0f95874f2fb99677785743da1cb776e79f9
SHA256872a87914672efe05d2e516c77266bbe28beb8a4fc29cfadc88df6f7d14869c4
SHA5120c307e85a9e0807e79393587a783b80a2b4240b619b8fc041bffee2d09eb2923cb6d5c9ee1b7a7172cc1c2bd72ab7a0453803539c856b66a129fdb4d323a31d2