Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
libstream_out_mosaic_bridge_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libstream_out_mosaic_bridge_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Resource
win10v2004-20240412-en
General
-
Target
libstream_out_mosaic_bridge_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
-
Size
7KB
-
MD5
dce3705cf11bb5fa6d122ef6c5a4cf96
-
SHA1
245c20b8e29115590c77a32467058f2582f6ab77
-
SHA256
437c91ae0f9fa48e61df2c3c94a023e7615daf5560986ad20554838c51a464ce
-
SHA512
59b1fa672a6024da5693dc3ddc218be5d46f4fc8cbf644b03bbf48b5567b2bf9f6df61aba29b4748ad19184bc0584758a0ca5c2884153fe2a76e755e40da4e56
-
SSDEEP
192:Z9vTPMcMHyx1Mvbv/Rv/dLv/cvCOv0mXHP5BxSpv/rvST/lo3fMvv7v/jvLBvyvW:ZVPMcMHyx12Zd7JmXHP5BxSBOT/2yiqN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4412 msedge.exe 4412 msedge.exe 1140 identity_helper.exe 1140 identity_helper.exe 2500 msedge.exe 2500 msedge.exe 2500 msedge.exe 2500 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 824 4412 msedge.exe 83 PID 4412 wrote to memory of 824 4412 msedge.exe 83 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 1188 4412 msedge.exe 85 PID 4412 wrote to memory of 4600 4412 msedge.exe 86 PID 4412 wrote to memory of 4600 4412 msedge.exe 86 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87 PID 4412 wrote to memory of 3856 4412 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\libstream_out_mosaic_bridge_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa069e46f8,0x7ffa069e4708,0x7ffa069e47182⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:82⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14788219823591046660,3758106867747067828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b1931878d6b8b22142fd7fd614add5c
SHA10e20ec0bec5a9fe3b6666c3009626f0420415bc7
SHA256d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904
SHA5121e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3
-
Filesize
152B
MD570ae4bf8f75c69610c1d00131c1ec28c
SHA1eab92c184a3b655377f375b1b25ef85fb06c7130
SHA2569f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b
SHA51229299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68
-
Filesize
6KB
MD5abf00d19237eb3494b7b6cb0b10370f4
SHA1ffe9493e053aef030b1d8bc6dd1be0cb0c72ed16
SHA256b2a4dc41f9bf0ac9b389d9df224e02b3eec919633216b54e3deb09cd7f11cbe7
SHA5126513f0835563103dc13ef866be09524b2ae0adbf4f9c4f99adfd284ee31bd848e7030fd7bbfd5bcbc6448794e3f550cf3cbd395bf9bab1017a8c46abc71401d3
-
Filesize
6KB
MD5c3a7d4f462e407bab5b80a32690529ee
SHA122513804257fbaf224e6ecee4abb96c6dbafe8e6
SHA256c0543651e8ce214308bcf88d89ea52bdbd531dc87cea7791bac884ddb711c3e7
SHA512c6cf52ef9dd71ee8a5ed72033a2ca56ed5390b218bf936766a036b1c2617e96bd9ed2308b46c5dbaacf68748737f2bc9dec391ca0cdec8477b4b4a222f762d47
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5c9ac6bd48efacc1e858b4df5df43fce2
SHA111fcf0ec9f129d448113a5013fa13598b978b0ef
SHA25618f9a035c2018490d27e9729ad24123f4108385a9775de9fce93114ed58251ee
SHA5121a4be93e6dc40519daf0543fef2e61318cde80472b1e8a72db3d9a49906c1983e4f3eca950b9f76bdc44966c6428b1f1d28e3e18772132e727a0466a3851c1ce