Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
libaraw_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libaraw_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win10v2004-20240412-en
General
-
Target
libaraw_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
-
Size
286KB
-
MD5
3f3074aad73128b9fe559884c2e77495
-
SHA1
5be75825ab6cd924e5a4191bac84aed22e0675f0
-
SHA256
701d2e74bda5345fa300a045e49c1d895b13d791381143deb1e8b6b568a3afe9
-
SHA512
f15b63f58ae57fd7eb8cd116c7d51876ccdf6dbca6b804dd2e95b23b82ed5b8c29e015686b6ac3373c64d8d365d0f5444753c414f0680656d67886f14410d03f
-
SSDEEP
1536:Ah/ADY68lEFB9uh6fdXmwZSnRVGk4uCzvOhIbS8wYpvJwAaJ/tMWE4mnJbCePPsP:Ah/ADYjOwW70wxHaJ6cuPsukFl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 404 msedge.exe 404 msedge.exe 5056 msedge.exe 5056 msedge.exe 1856 identity_helper.exe 1856 identity_helper.exe 2736 msedge.exe 2736 msedge.exe 2736 msedge.exe 2736 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 3556 5056 msedge.exe 86 PID 5056 wrote to memory of 3556 5056 msedge.exe 86 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 4136 5056 msedge.exe 87 PID 5056 wrote to memory of 404 5056 msedge.exe 88 PID 5056 wrote to memory of 404 5056 msedge.exe 88 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89 PID 5056 wrote to memory of 4836 5056 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libaraw_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff948d546f8,0x7ff948d54708,0x7ff948d547182⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,576734150618032471,4761929839985206131,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55e2f0fe48e7ee1aad1c24db5c01c354a
SHA15bfeb862e107dd290d87385dc9369bd7a1006b36
SHA256f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9
SHA512140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e
-
Filesize
152B
MD57e0880992c640aca08737893588a0010
SHA16ceec5cb125a52751de8aeda4bab7112f68ae0fe
SHA2568649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2
SHA51252bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a
-
Filesize
6KB
MD571483c53729e3366f086c9c9bcda3bec
SHA1bd5170007cc7970894ea462b36ea020414afe2b4
SHA2560f720412461505a23e02b8bb7b20a7cd2f923ded76e83896a0e4f007f0293315
SHA512c905bb59d8b6fa0c6285bb8e778448d368d7d8c0f89efbe1ab21eeb2542b8e06a6df4f3a56477c4b84a2655bbaf43bca8a6de4cb310cf2c6a736e126b32d6c51
-
Filesize
6KB
MD5f345e71666db971f3082c493c4ca2185
SHA19394ad0fc9fe40ec96bb0b210d969376381df0df
SHA25623e2412c0fae171a1a786126a705088ac5343b4c5504b72bef0ed091241a9fd1
SHA5121f21cac9166c87a8aa60c8cb842d5ac521d7a7bf5b7ec1483f2258be47433a79f7e7fad3d6e13ac99dc254622b17c224595d604e8dd00e66eaa93384793bf217
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD503dd84fdb2592c7debcadce26c2af945
SHA13bdca9e30d695987bb5a31f5bb473954a0f4c844
SHA256acf0ec3b979aa2b7c75dfa0fe56ae2ada48d3e2f7b539ca7dac957a86eb40df2
SHA512add37901db2fc25546c39802887f5aa00a00c08bdce02ff89211ad0b8b1494ba132581e22ac5ca1d5e1ead9a1845c47b8c614a021ac6c86fdb9f5548337858ab