Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 04:14
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
c2ea98cc5f4b382604ba1b9565d87732
-
SHA1
cc8716b1a5d48c2160fe3b05107c5bc60f0cc92f
-
SHA256
f792b45e740b15be04c7806a6ba43860f61fcb2704684638de23fa7bcff684ad
-
SHA512
a6bbdff79778a1d1e496ab556b1bb65865139284704eeabe3da18d4bb5658b98186e5852ff2a56399f001e02c7c50c1fc703c8832b4c3090df5db660e37fd637
-
SSDEEP
3072:SjwsRsdGt0XhS1wAtDpDvQ8xRXPxsWvOcLxfJWawD+DAKrXxDXeejg4cDUMAqwox:SlTXiHsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 2928 msedge.exe 2928 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3376 2928 msedge.exe 83 PID 2928 wrote to memory of 3376 2928 msedge.exe 83 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 3396 2928 msedge.exe 84 PID 2928 wrote to memory of 2976 2928 msedge.exe 85 PID 2928 wrote to memory of 2976 2928 msedge.exe 85 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86 PID 2928 wrote to memory of 2216 2928 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff44ee46f8,0x7fff44ee4708,0x7fff44ee47182⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7392905096388345662,12025825369215519102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD548cfa1e9a5b628043ad638af28ad4599
SHA18bd211542330028104f29a3f5b06515c0ce60c9e
SHA25688ab5971cb8bee77248c6d9a11c460a78b3efb90161c49ffbaeb89c2c94daba3
SHA5128b7b7918a6f6f7194b4ffed105603e4345af149fcad45ba9389aa7acdcae3b28ce459bf885c030f296f5bf25c8b3fcf42e385a64e3633b8710b84c28dec25659
-
Filesize
6KB
MD5d21e4de41c00b97d15791f8c72072fe2
SHA11d5055010043c195ec03e3525510cfcfb483627a
SHA2569ae6677ea6b713404ab8845bc1564517968eb05e400685ed06cdafa0c7e68419
SHA51233752e9c05c9255bc12979a8164d3b775dda362780dfc630089d50ba29784c169ab3f9e46295a8ba4cdf1dc6b1d8d300fa373052d7a2c6fab7c9e7f4af9898cf
-
Filesize
11KB
MD56c388b329139fbd8f7ebacbc0e7c87c8
SHA130ff4c360c88b53ad70493e1d71174f2e188a2c8
SHA256735c3c9c8b14cca40bf928c40f7eb0d9fb993b43301b9244e251a83c96d94c7e
SHA512c794daca117692e20c8de841d6470c8eb787563d63dbd4e22c03f5c5f67850476c036a3fc87601585a191f5c541ac4c9c9126df01c627abdcef60e6cd81d3175