Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2024, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
d76fe44e45a57b232e1abea85091738e.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d76fe44e45a57b232e1abea85091738e.html
Resource
win10v2004-20240226-en
General
-
Target
d76fe44e45a57b232e1abea85091738e.html
-
Size
10KB
-
MD5
d76fe44e45a57b232e1abea85091738e
-
SHA1
ffb6424db096c26a1e89b52a4b93964a83346959
-
SHA256
f0f9b7ab2b479b3ebb154c42831d427c9f3f901db5cac7a5cc872ac8d0bb8129
-
SHA512
18171d715ceb8152fc6fa3592a660c5a7af212a2bfe695141a243dbc38424f76a97689880af1e7572f0b670c73d4a67d39e48134ebb2dceb1d44a2bfb7eeaa6d
-
SSDEEP
192:SIGJ35WPNLu4VDMFVMfBt/lMvStl19YeSt03araxj0+nVSWd+jp5Yry3x9hOc:SI+8ooX/ssts03aC0BzQmpOc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2428 msedge.exe 2428 msedge.exe 4568 msedge.exe 4568 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4568 msedge.exe 4568 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4912 4568 msedge.exe 88 PID 4568 wrote to memory of 4912 4568 msedge.exe 88 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 220 4568 msedge.exe 89 PID 4568 wrote to memory of 2428 4568 msedge.exe 90 PID 4568 wrote to memory of 2428 4568 msedge.exe 90 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91 PID 4568 wrote to memory of 4820 4568 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d76fe44e45a57b232e1abea85091738e.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa415146f8,0x7ffa41514708,0x7ffa415147182⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,11804174426001495506,11254271628841036993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4408
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
Filesize
6KB
MD56f98df65fe2db36093be4e6efa58abe0
SHA102f56023e9af8c02abf4d3274eece1fa8ae3d6eb
SHA256c105b3f9b42f8acb6900580d587986ee746e9e9d295d70be7a37d260f9848fad
SHA512f370a7fd3f2f8ce0114ccf6e0cebebd502b6e6b2029466de9ce48024e3e90903fd25a708910ad9004b517bbd70b42655811c8ab843acf5bf915a52b408191e34
-
Filesize
6KB
MD577a796ff8de9953b2c5aaf38ae2480d7
SHA1ef208c19db58731e19cbff1a72320f35c65f72db
SHA2566afa827738deb166d9bcc61cd4e2649295ae7a790d7c59b1816e79b0ed2dc44d
SHA512289ea364bf71f69cd0c4b57ac4cfcbe98ed949f35bf02709736c51d34912d366793eff17bbdf7b1e324b6423b4ceff32cfeb842503677dd9246ec139b97d1f63
-
Filesize
11KB
MD568e606829d3ab5cd856ce026b90a208a
SHA114e49b079b41a2da9c45eca040f65a38ec8b8932
SHA256ac8f3529316e34104e3253fe1c62be16149a4a4d2021b9fc3b5ca7836ece3c6c
SHA5125ac7fdfc46baadd904b37f583c1dd3ea2c3064121d25014a0f89af6e1ad2ce22e418ac54068685ace790a17a1aab0acc0c869d2bd2bf97dfa5c9a3c95ddfb0a1