Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
2ae75a4f96dd0522f6358b946d7ea7b1
-
SHA1
54631e7bb796933f1e2a5d339ce6ef98664fe933
-
SHA256
7f78c48a1886990fc4e5ac5f4c72a5c8e1cb3b1332d7100a764070bcbe65b541
-
SHA512
60703df74e3d2dd47aff8531cd7d9f8a963679c39130dffa45c727e78370c587da3f4c1dff8ef8cfbbc46d5e11d4321da36d3b59d3feede2a80dff0cdac02887
-
SSDEEP
3072:SqaGVpAq2679CeOvyfkMY+BES09JXAnyrZalI+YQ:SqFEV657sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4148 msedge.exe 4148 msedge.exe 3696 msedge.exe 3696 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3696 msedge.exe 3696 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3696 wrote to memory of 2432 3696 msedge.exe 84 PID 3696 wrote to memory of 2432 3696 msedge.exe 84 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 1912 3696 msedge.exe 85 PID 3696 wrote to memory of 4148 3696 msedge.exe 86 PID 3696 wrote to memory of 4148 3696 msedge.exe 86 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87 PID 3696 wrote to memory of 3484 3696 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb5e446f8,0x7ffbb5e44708,0x7ffbb5e447182⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,8771959829103415334,686313045522035379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
Filesize
5KB
MD554d25c96b5a9ba77eddce019e130fd06
SHA10779ca74943b7213e42273f9c9aeb42c6fb6dced
SHA256c9ad7110bd262e725444cdcb5a3d58b80627795d20127fc6c7869320b304ccf2
SHA512ba29ce58911f5403b54d80d24fcf1350517dfb299081c76cf4b1d8708be8011a33e304814c27d19ef92ea88374ffb31172fccb7632fa5d0486e4a05b56b6ab21
-
Filesize
6KB
MD534d5bf55fd33921249ccf9cbb620d0ea
SHA16c1830b721911d32d0a0c9cc7d1cb07513bf6e7c
SHA2564e59e7d0206a9e48d25f70bf617d28298c77e6a2865887e7767c091d270ca6e6
SHA51251b278f7b65135949ef9d9ee077df3e65cb03249b085d227dbcee7eac9d3d86a6ea1cf86d00a932db89f2245642e7bcfaad0e82db0f1508e17f903b0493c329b
-
Filesize
11KB
MD55dbeaf51d2176c9be7d36819e8928b7b
SHA1042a6cb67c648db72f611cc6b86b924138d54f12
SHA2567b3fc76dbaf50e6816586a2346c582890159388ffc6d2161671e2663747ab56d
SHA512c124b85b666af70cf38980446f498f1272ee04f7139c410d9af631b38fce0b82c62bfc5ccb1c150782ce711a2bbfc5a85ba691bd1019c39a7c1033b7f11cb590