Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
e0ff4aa19427569a916b6d95bbc5e23c.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0ff4aa19427569a916b6d95bbc5e23c.html
Resource
win10v2004-20240226-en
General
-
Target
e0ff4aa19427569a916b6d95bbc5e23c.html
-
Size
83KB
-
MD5
e0ff4aa19427569a916b6d95bbc5e23c
-
SHA1
c9d88ef5fb8804818fdd0cd73282897302e081a2
-
SHA256
8dc4fab77b3e8b8d5a289199dfcf0d1f4cb2514d3d00fa81dd57b47275f02f8b
-
SHA512
b3c13bf536495dae269aa04cfef2fd8d57a1222d84d22644f8a02dd2e902bc2aa856e3e3f60038836b93d4b8753deb860d1e1e21a15b6fc8361de891958246b8
-
SSDEEP
1536:IlriuaSr0Q70NcNtxNSNeNBNYNoNJNbNGbxQ:Il+uaSrZ0NcNtxNSNeNBNYNoNJNbNG2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 3192 msedge.exe 3192 msedge.exe 5584 identity_helper.exe 5584 identity_helper.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2108 3192 msedge.exe 90 PID 3192 wrote to memory of 2108 3192 msedge.exe 90 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 4760 3192 msedge.exe 91 PID 3192 wrote to memory of 1672 3192 msedge.exe 92 PID 3192 wrote to memory of 1672 3192 msedge.exe 92 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93 PID 3192 wrote to memory of 3480 3192 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0ff4aa19427569a916b6d95bbc5e23c.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd794446f8,0x7ffd79444708,0x7ffd794447182⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:82⤵PID:5568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:5656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵PID:6024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14274034215909016084,11462116113846199042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5432 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
740B
MD5ba1eaf89c24ad04805687ee493d3fc87
SHA102a1d96b7d44becac68e66c9e0d89a896b492475
SHA256b006c52a3b2b64949f23943ebeebe3cf0c3192eb191990b56140f52ef7a3220c
SHA51201b30ca31fc6ca690c65baee573de37592d745c9f1ffae4908d3f574e7813fb5428fde1abc66bfacb8b72bf8d1557adf1a7ee5bc36d4813e14c83a87b86d45ce
-
Filesize
6KB
MD57c07f3e462474cf3f0463db9df26d8f5
SHA1784e1ba0e53c2c886e967deb97d7b0936fd01d40
SHA256866dbba411249f334cb88348916cb70146c5fd8cd945ead7a5d5398206cebb8e
SHA512428d236112d9c629b31d7cac4cd6ea972a0616e8633545eb09b1a605f7da03e7b17adc7d6b7c7ec0fa377d8815cee083a66532dfdf55cf25c2f69f272d7f2508
-
Filesize
6KB
MD59a7b1b62e6ae7e6ce9e453074ec5ec79
SHA12cc277b0171ffe05712d6528912987c75a791712
SHA256de9fa81b59c0bf05d926c95608f6db4eb72a2ece1894d92bd57fa89e38162fb9
SHA512071bc25db68aa7c09f4818b287421642571ce05deceeec7719c2bcb45509bb5e1da8b6d357c33d276aa65dd3499a919c261eac1d60903f6040185ef8523e27a3
-
Filesize
6KB
MD59c2cd25b961cffc82bd5cc0aea6953bd
SHA1ad333a85392fe7ba9444cc53810a78a278c95609
SHA2568eda377a7ca00083b93aa2da7f1ffa4701d946d68ce473d9bd4333fa4c19b942
SHA51225efa474a64cf6364fe1826f6007c311f8beb32765ed223c8929c00b33655b156fdbfdf58c8c567c935fea85f5df23f30e4155d911cfdbfd4eb36870d238f347
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD58bd8cf172dbbab51ff3787cfb25ca4e0
SHA102f75305958e9d6f5e55b282da570f283ba9d6f6
SHA25684601fce153d9f6cf63e8dd9e00ae7cdbeccc2f19452c5e7830a172cd12eb139
SHA51298bc8cd99d187ce9a4dfa5b69666f02cf395673fa54213b2c6f0d62e7ab015323702c0980cbb0ffbc72ec3cfeaa08b447e713448ed2e9996c462b4c763bcc1d5