Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win10v2004-20240412-en
General
-
Target
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
-
Size
15.6MB
-
MD5
67a9225e3a5a2c367b950353e0c052e3
-
SHA1
8592ae20281b057d56de6945b7b712d8c7a3f79a
-
SHA256
68dc19a4e00817951a0328c88d18c3925332e3c37da50936dd3143df43f4ed92
-
SHA512
ed1581e82c5a03f60480c748eab033beeda1ba1488df42c8ec8a9a38ff48b8bdd2e66cb91a50b20c5cbcd61470777539e12e4148988e0f7fdad52f5be1644f70
-
SSDEEP
196608:NIy06k+L4MNEiRTSfKSARr3BlDvzmnMGhS8/s39Gzne/ehNwellqHpFxVRxZYHIH:PBsX+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4220 msedge.exe 4220 msedge.exe 704 msedge.exe 704 msedge.exe 3480 identity_helper.exe 3480 identity_helper.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 704 wrote to memory of 3844 704 msedge.exe 85 PID 704 wrote to memory of 3844 704 msedge.exe 85 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 2780 704 msedge.exe 86 PID 704 wrote to memory of 4220 704 msedge.exe 87 PID 704 wrote to memory of 4220 704 msedge.exe 87 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88 PID 704 wrote to memory of 2352 704 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libskins2_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2d0346f8,0x7fff2d034708,0x7fff2d0347182⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:82⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,1317863734596427230,15671077995131094990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4260
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57b56675b54840d86d49bde5a1ff8af6a
SHA1fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811
SHA25686af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929
SHA51211fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9
-
Filesize
152B
MD548cff1baabb24706967de3b0d6869906
SHA1b0cd54f587cd4c88e60556347930cb76991e6734
SHA256f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775
SHA512fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6
-
Filesize
6KB
MD57c420ee68399e66587d999925f2a27df
SHA1d3dba6257d64c1712ac2136108c992c8ff2a0741
SHA2561cda86dd71915481853f65dcc3e4757976f2d2928fdc4a5a504262705feae955
SHA512ad3cdc8f795b33ad44c2a420d16d1a523b2a04874a5839ccb335760a889f6358f1f9112263da69e74e5d90679574fbf9f1a96f6b57652a4357841eae65909bdb
-
Filesize
6KB
MD5a2ddfabe0efe650ed719a92445be3447
SHA1efadc25ed2bca0563d406413d9d9bcfacf161e58
SHA2562dae20df9b1b338951b8f06f478ffda0683743d9d4a69e5643765f954335a83b
SHA512e235a50d1b7a47f35e69af9d64c2e045f0c12dce9031defca624873ad47f0a953177fb0cde4c72d06c4b1b3cbe7154435938df855f014950cd2b04de4e058874
-
Filesize
6KB
MD52a5323e998bd58513fe6e1d34d61ec02
SHA167e31ee829153a4685d04dab01f3fb55b3a45548
SHA25676f3bfb4625e6870390d812f876b6ee48ebfc586e91e78a9085ac07025be0962
SHA5121cecd2402954610bb0e126120060190eb7f99e0bad995bd998822e579aaadb8e5894ee9009b2ffeda5abefd51a885f4abda2a57f64a9ed56cc7cbbccdd4ab7a4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50075cf9acd7eb75752b56a134025c6bf
SHA10c03234b86913574d5adb0318d4d28baae02adff
SHA256ba68f931d2c1c4395b5a761bdde955e246e960deb99fbef5069e4786477fbf6c
SHA5120039b0715b9ced3153474f7357a1ad48ed8db03b28a63816b86d0fca6461331b7da72824f4fa5ff80dcba229a90f75a14ec467200460630bac443fdaaa105f47