Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
ccc8bf9d42bba902d54b3b8625768517.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccc8bf9d42bba902d54b3b8625768517.html
Resource
win10v2004-20240226-en
General
-
Target
ccc8bf9d42bba902d54b3b8625768517.html
-
Size
40KB
-
MD5
ccc8bf9d42bba902d54b3b8625768517
-
SHA1
2b80be5c6043c2d219ce3853b75ce16fd0e4992f
-
SHA256
c7ba117430cc32baa1b9b9daedd642d986a183eea36959be5987189094cb2beb
-
SHA512
ca69fcb86310665cdbf6e6035c26d9ae29c8192a19705f82508f719ce8399223fc382f72674b080b382e38fefbb3770640d0902871b1a8183f2f4c521a26efde
-
SSDEEP
768:cIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZmN7:cIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sq9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1644 msedge.exe 1644 msedge.exe 2392 msedge.exe 2392 msedge.exe 2044 identity_helper.exe 2044 identity_helper.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2184 2392 msedge.exe 89 PID 2392 wrote to memory of 2184 2392 msedge.exe 89 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 4756 2392 msedge.exe 90 PID 2392 wrote to memory of 1644 2392 msedge.exe 91 PID 2392 wrote to memory of 1644 2392 msedge.exe 91 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92 PID 2392 wrote to memory of 4556 2392 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ccc8bf9d42bba902d54b3b8625768517.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa356346f8,0x7ffa35634708,0x7ffa356347182⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:12⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:82⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14580534863469430854,2228567256877392022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5916 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5020
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD542e3cfa39baa79a7565fe9f8e6653bbc
SHA16b002d22b06c6608730ae29e4a131002795ca25f
SHA256978e6bda399880dd1556ebc46bdcde9b02194686ee0222a4409189c75190e9dd
SHA5127d0286b833481a88deb03e9d0dd4727ca90645c96e5634f1285b5ff11505ebad3f2f157b55f53b24a68c7a58a46acc278bde62fa9c1c82d5293b0b2da110b55f
-
Filesize
2KB
MD5146d2fb86c77b9d9b7b9855369b19f95
SHA19694b5f7470c4804f25e87731c9cb77b5292f1c7
SHA2563d44df0971a54c2b358dce5c56b18558fc36313732129c3be352ad510f9665ac
SHA512bec94917094c243fdb4486693a75d3114cdf12641070a8c937a36f073865fcf7050543bb51c4f10b9fbe69b0ecd77a08c14a03ab1b0ea9bfe4a8eb3eb2f9fa27
-
Filesize
2KB
MD5bf87cb36d3c6c89b3e5ced438b6a9a2c
SHA1c77f97dcbef19f6619715015aa48eae53e42eaa8
SHA2565fabef5d6e2973438bfdc2cfe3c7ef96de6e2be9b76174e4a723a8d0481abe53
SHA512e6361215e756fb627c2928856ca6e28501e099504598188ee85cf89752e5c29fb6d9a4c295469339405505b40788958c6dc74fe645180e87aba7122293312dfa
-
Filesize
6KB
MD5fae69d8dd91679b0583663c0e9e893a5
SHA1dc55d9c3d8bd3d9e36f7175e8bb1d465e602636a
SHA256510b98cc2dc50a67a2ff7643bea24373f4634ff92914f3d3bb33c2315a31b59e
SHA51293e442096839efeb305f3309b48ba6109fe93e0c2e17a47c0686cf6fcb238d172a827102184581ff2e51b8d5268f6c96a1e36e5de92b4b08d549e69b45ec6d0c
-
Filesize
6KB
MD5e37511bc9c62b9a92595844fe40817a4
SHA1476d7e88e02676e3ce5001f3303a4c626045f1fa
SHA2564aa5abe2077f3737e69c4a4d503518674fa19fc5d4ba4d7464824d3b9ccf236c
SHA512ff72853dddfedb7ab505db1ddbc92f50b0a320b79067ce997cf81d8d232e4447cb4d7269051503e1de1e155f8b3cac10539473b42d7413208006789b0b72f706
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5dddc3a126aa68832ddf9fa02e0eda21e
SHA17c42e475c1bc42fecc68cde7b5ae204817003cf8
SHA2562446397f55b9286cb6bc3a9e097cb2730a217167cd77ee6bd831cf3a2e81530a
SHA512d13a1f0a1c6df5786d6ede5af17fdf739288d9356875e8436d1fce524ecdf1d649ee0cf69a3ab161e93a8f684c0f02bd6da5d7a5df71196179f4896bb77cbd19