Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
sample.html
-
Size
220KB
-
MD5
27733dc85066bff220928281374092b5
-
SHA1
dc7ea83c8b5fff5f044ef49d36f5b5644d5edba8
-
SHA256
4e40a3eeb3add545c2a40627dd5f67c40bc6935284d0f07f5597083a68d7cb99
-
SHA512
99a4c9a520a92435ffe388f91841ee1c62e5278254bc3b4e9dfce7f1cd8edfa74683c886746649fdf611b5a55370cdada4b0e8a59480e918382a074766186c8e
-
SSDEEP
3072:Smkqs2wdmOnGvyfkMY+BES09JXAnyrZalI+YQ:SmkRpZsMYod+X3oI+YQ
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 60 msedge.exe 60 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2584 1348 msedge.exe 84 PID 1348 wrote to memory of 2584 1348 msedge.exe 84 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 5040 1348 msedge.exe 85 PID 1348 wrote to memory of 60 1348 msedge.exe 86 PID 1348 wrote to memory of 60 1348 msedge.exe 86 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87 PID 1348 wrote to memory of 4960 1348 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd13c246f8,0x7ffd13c24708,0x7ffd13c247182⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17338819502235631122,4355462296887414953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17338819502235631122,4355462296887414953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:60
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17338819502235631122,4355462296887414953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17338819502235631122,4355462296887414953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17338819502235631122,4355462296887414953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\886f0d92-ee5c-47ec-b82d-774aa1b0c31c.tmp
Filesize6KB
MD54557ec3b5a4d544f35efa7aa8a2e2de8
SHA1c00f3107cedbef113fbf539faf4bfc9f2819e27a
SHA256f4f2765e9e76394f28a284e9f2c81730d24fef630fbe5b11b90b5bddad3793cb
SHA512744b4cb2ce71d129fdc03099f20a390c71986cf2b6a22582b955ac15630fd523b0f18e7f62e5808938863ad4414abb4d774e405693df28caddfad9071002dd8a
-
Filesize
6KB
MD56f8b6de30f9c3f05c5be7f6383426440
SHA1fef4d62b1c12b2d289b0ced01ad37737e2866ed8
SHA256ba2601c272ef35b78b05e249593958516443e5a4d2df586de8dfb3b9f2923e25
SHA512bc0f200e9e8114b378278bca8d4613f4be51babe8bfa1a398ccd2c0bd34f0c52c113700f0b7e1442647beb0a045ce9bc3b4b231a8139fd2e814e3789ed0b88f8
-
Filesize
11KB
MD5e5375a791fdd4561cbe25468c51e0a38
SHA13f301f745c9f037fc929c8c47c9363bc926ce4d3
SHA256049344f522c0984e8287af4432e525c96acd5e8e3a68125ede3011e5b697bff5
SHA512528b83e1be6ac4d5c604a1de3d04d244ce95fcc6ed31f6fc754738e6f38cc492911753a4c987eff23e4d9d3d0814d3a847db73221c3b6e1c2fa3dc60ed411d8c