Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
e188b046b7c1ab953290ce00dae6fb51.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e188b046b7c1ab953290ce00dae6fb51.html
Resource
win10v2004-20231215-en
General
-
Target
e188b046b7c1ab953290ce00dae6fb51.html
-
Size
4KB
-
MD5
e188b046b7c1ab953290ce00dae6fb51
-
SHA1
46ad98599f6128b365183c919422414c63c80a53
-
SHA256
e35eaf7f9d1797d3d1f8b4df4a638698c37f733b776a5bee0396b25fab2ae47f
-
SHA512
3c4090a1ae80e7536800eb50cbeb6c347f21ddde879d627629059524590dfb1ff8deabfd6e806d15c7bf158018de24b2271e7a0bec8668c7824cdd5296d6c609
-
SSDEEP
96:3V9xuUhl0vD+an4Yxtrc82qhuztye7o2TpBVoGCtUz:3DxuUh6t4Yx5c4SdoCo7Sz
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 832 msedge.exe 832 msedge.exe 804 msedge.exe 804 msedge.exe 2348 identity_helper.exe 2348 identity_helper.exe 1764 msedge.exe 1764 msedge.exe 1764 msedge.exe 1764 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 804 wrote to memory of 224 804 msedge.exe 85 PID 804 wrote to memory of 224 804 msedge.exe 85 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 1712 804 msedge.exe 86 PID 804 wrote to memory of 832 804 msedge.exe 87 PID 804 wrote to memory of 832 804 msedge.exe 87 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88 PID 804 wrote to memory of 4152 804 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e188b046b7c1ab953290ce00dae6fb51.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef72146f8,0x7ffef7214708,0x7ffef72147182⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,953317224304585644,1327932129567702591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5b63a74a0b66b683c53e92df6b61313d8
SHA1c36ae91a708a9f8ea1a219a8a6ecd4830c837145
SHA256f4706069619d04262c6fb229e26be2d47ccb89c4021573ee62a11769813d38d2
SHA5126fa09e84ae203bbaedbec26f2e0676a9d51049da2228861dda9784fce38464c52eddb6f194ad4eaa94076ca764d155280b3922e913764962597446b189411c5f
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5fb422f50487a1a11bab0d69e935a7253
SHA171666ab66b2d9118167301056e2a0640735cc3b3
SHA256addbe9bad8574b82321ca3a3f5192b3295e97955732e81eea1266c6556809cfc
SHA5123444c2908d0ff9671c266ba741ea38788f52dfa2749c9401c8950c90d6e16be903d6477595da5afb0a3052d25498fdea800b6683cd75c2aa2eb67962ef6c3396
-
Filesize
5KB
MD55fa799254174864420bb72c200a7f263
SHA1b6520b08b2b3044c1cc324d4081eb141c8801eb5
SHA25654d329b865de61a2d7e96310b480d473d7ae96dea7b61c70be59cc88501971ac
SHA5129bf344fb67509d8742762174631a47262ba8d9a6fd95b218f379a4e17e1954b6f32e8146935b3d6b710acf895f9ff66dbca9fc043ab1a77fddb7d0d448b049ef
-
Filesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5167b99bfaa7d18f3d89df3f80bddcad4
SHA106420e62586ebeffb35a0611fb17ab97ff4660c0
SHA2563da2d2b6d5a9e5d91f09c1445229bb9dcdeeecbf341ee3e9ed5a047a07152e4c
SHA5120da90a5bd2e588eb4903b862b416e69ca2c1f312e16d63a14e7b046edefe2c3844308971c6cbb72c5d0807c1c5204ac7bdb3f9e2d44dd027c5a7038316bfe217