Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
beijingshijian/time.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
beijingshijian/time.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
beijingshijian/ʱ.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
beijingshijian/ʱ.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
˵.html
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
˵.html
Resource
win10v2004-20240412-en
General
-
Target
˵.html
-
Size
3KB
-
MD5
f3d0373771f533c824ef71930d30d001
-
SHA1
4c37e7b8a49087149432980e29477528718901f6
-
SHA256
cfc9c3cfb4f31069941870cd9deca1e66b97097279c33f2104d0911130df7cf7
-
SHA512
136c4934d74681b30dd398629e4ee61218572541d7c4d5a8a568d6c69784bb22c5638c056896a9e1bf7a1457bf8a4fdb1abf8cca3594cf4c7f36c5d9f06e4f07
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 916 msedge.exe 916 msedge.exe 2368 msedge.exe 2368 msedge.exe 808 identity_helper.exe 808 identity_helper.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 868 2368 msedge.exe 87 PID 2368 wrote to memory of 868 2368 msedge.exe 87 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 4568 2368 msedge.exe 88 PID 2368 wrote to memory of 916 2368 msedge.exe 89 PID 2368 wrote to memory of 916 2368 msedge.exe 89 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90 PID 2368 wrote to memory of 2188 2368 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\˵.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4f9d46f8,0x7fff4f9d4708,0x7fff4f9d47182⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:82⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17994663731938625348,139352722220161162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2540 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e36b219dcae7d32ec82cec3245512f80
SHA16b2bd46e4f6628d66f7ec4b5c399b8c9115a9466
SHA25616bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b
SHA512fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c
-
Filesize
152B
MD5559ff144c30d6a7102ec298fb7c261c4
SHA1badecb08f9a6c849ce5b30c348156b45ac9120b9
SHA2565444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10
SHA5123a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04
-
Filesize
6KB
MD5e4742dd4a37e3399a90f36ec6fcf3c5a
SHA182a0ddf570332461fee02e72398456d167d28eed
SHA256a324fe3ca0d3eae511941f26ee5ddbd6d6b20a9613cfb6bc9ae1d18b5ffbfbd9
SHA512db7465e37e8ebb6e20ba53fb0eff68e3cf7b1ea9a7cdc3955834ac8f0200fdd86929cbc42add67353d8d1cb87f5f444d9fad7795b2252006474d2f4d456b0f6e
-
Filesize
6KB
MD5cedac4ded406f9fe10c70853e0b83bf0
SHA12c4e1fee1bc42e4e29ab3545e9cf88d4d884ba23
SHA256690ac81650b55fcca13e5b0cda1ca73f2faf3907ebf554cf1a85fd96c691c80e
SHA51286b62abe874fa9c4811dfe21406de9418fb765071bc57a8a8dc9f78b131c8e413000c8b134e339d4501f623d6f5b3c19e9f21494bb36e2ad9761936c6d0f7fc7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bfff3b4d73ca5809aa81ac7d4e86f8b3
SHA1dc1d76640b32a9622e242592c4a639f6a9f42725
SHA256b3578b9115e36145c44b59478f573e15d242500cfbf917c13fd421c04c7996ba
SHA512709de7c5b1dc156ef29ecad00b96086be4796d7d0e11828bda851d79474c717205807fbfdc1f53777adf146b938ce8aa66d587c8f87d887266385e054ad5f88a