Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
libadjust_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libadjust_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win10v2004-20240412-en
General
-
Target
libadjust_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
-
Size
15KB
-
MD5
30df49615315a50becc04156876b98e6
-
SHA1
f586c79b1bc19747781e465fe4ce6dbeb3a46e56
-
SHA256
0f7e144a9aa8a70472831fdff3784af6aa627a6abbbf2f77ad8ed130340fd9ec
-
SHA512
8e48917d131372a485c1ac2cb19ee4014d07d8de155b20327ff32dd6806d4b284e05601dbd4e27d22ceb0a7a40843f2f6613511c4e7492d3fa1a244a9a995325
-
SSDEEP
384:f+PMcMHyAcaU3jQdcvXkvDZ3eaNaLJzl+Cq124kbrBZFE8uI:2PMcMHyAcaU3jQdcvUvDZ3eaNaLtFE8B
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1816 msedge.exe 1816 msedge.exe 4256 msedge.exe 4256 msedge.exe 5080 identity_helper.exe 5080 identity_helper.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 1548 4256 msedge.exe 82 PID 4256 wrote to memory of 1548 4256 msedge.exe 82 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 4368 4256 msedge.exe 85 PID 4256 wrote to memory of 1816 4256 msedge.exe 86 PID 4256 wrote to memory of 1816 4256 msedge.exe 86 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88 PID 4256 wrote to memory of 4656 4256 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libadjust_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5b9946f8,0x7ffd5b994708,0x7ffd5b9947182⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9796441121630445008,14242713602905085955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4168
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
Filesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
Filesize
6KB
MD5f4ea05a60ea84039df11edc0718218ea
SHA13240faa40b7418ccf02c2e4eae5cc8d55673be64
SHA256eb69074ee9616406cf4ab1202bd558bf5d7dd87351dd26000edd5e5d407fd875
SHA512a03df9f0000460698ec71b7f11122d71185c8222511bd110b7fd3625b77bb6029c750b7908957aeda9d58304105d189c36410c2a149f6ac0a9038b50908ea66f
-
Filesize
6KB
MD5e47d91d7da2d8f7f146c1f4ba2b5fb43
SHA134f3890a9b92d99d6ae4dc7f6cc0cc3c68875eba
SHA25662e92931cefb8800a07a6bdd6ab0f9286d57faa39adf00cad55c2fc4fb4e684c
SHA512f8e287b749e7d31b5094306e3c40756322f24fc1e0a9a7df8c6e3894bdea469ee1ea448270464dc8241be14f4276f3a239b71cecf963a88f80d39cc7502e6290
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD531426074e371dfee3e1cc577bbc75892
SHA189a9777e33b0bc3ad4ba45b95add598f53efcc2b
SHA256537e2e27b2ea8a7c8a8965bbad6d240902152752a0e1a9f05c0a7468a89e8fe0
SHA512274d8ec5fa2733f3b2e5c05730cef55d0e979f1481385f37c3fe2b24599648e90e69e5a736da1ff745f71b6804756f0d3e8cdaaacb017aa5bad9182588127fb6