Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
a8e5e2f577294671f97726a6ad62d1ed
-
SHA1
2b061ba5092f26bf7d0c33071910521cf61052d9
-
SHA256
e723cb17539d0fb1d1dc26fd0189904086e8168d85c02e2d481a79afffdb642a
-
SHA512
2bdfe151bef57b383b947c96c898568b37c4cae9896545d26c374f3757a0b31dd4122a60ba338a4b21dc16b13b292b486f4b0af631685993764616abe5a72f3a
-
SSDEEP
3072:SkmKMeh/HgGGyfkMY+BES09JXAnyrZalI+YQ:SkT+gsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3232 msedge.exe 3232 msedge.exe 3148 msedge.exe 3148 msedge.exe 3148 msedge.exe 3148 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3232 msedge.exe 3232 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 3800 3232 msedge.exe 83 PID 3232 wrote to memory of 3800 3232 msedge.exe 83 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 1660 3232 msedge.exe 84 PID 3232 wrote to memory of 3016 3232 msedge.exe 85 PID 3232 wrote to memory of 3016 3232 msedge.exe 85 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86 PID 3232 wrote to memory of 3028 3232 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa322e46f8,0x7ffa322e4708,0x7ffa322e47182⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12317456890950188206,6779516509462800200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3328
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5a52f3824df37fbb50d19306ab2b2d127
SHA16ffa1480809822b23308a01de70fc7bfaef5b0d3
SHA2560a2591b01265c5c411a4da5ebd71c3e84669794cb580f7426ea7aa99c6ae015d
SHA5125a0bcf82a914ef595f1a23ef1718028caaf90a33e0765402e6c818dd706181edcfe43130e5b88d3a0904461c40e8195ea0c115ffc303c811760bf853519bd7c9
-
Filesize
6KB
MD58c800b256e068dbd1d67ff20eef6fae5
SHA15ea1ad57e6bb2ca1b5e0ce0f5921fc51af794464
SHA25643d94e5c01505c5f0fe82c42d94556ef36aaa832f4bae6ee03660c2949ecd678
SHA51261ea1d93360012b2931a9b33df9c81e0c34af3d9bfea9ea53e39d46e68499b9a35c90e2a53209dea897a501ea4b9dee33beca15ac808f5b3dd6d0583dd559f3e
-
Filesize
11KB
MD5742df5a06bd4d104ba0f9bbd42f9fb47
SHA1a1a807af323844486ca29aacfa10679aea67a9d2
SHA25608ff350ef75e8ca8416f00e7fe2ee724101b545afb18c7148f40ebc30e48df7b
SHA5125485b7d42af1a617121f934e28447a726ad0b7fe5d569cf0123d224d493ee12f360e8e052d634b8eaf72eda118516084371d30783e13e6f3a24847262e28b203