Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
b25486e898f5337f5cba05f2bf0a6f12
-
SHA1
0632b578d755382e722c1fc0d92663762ab04eb2
-
SHA256
795fd061bf7fe6463e724184a7355771bcdb282a7a872b5ce940c69cf8c844cb
-
SHA512
b77426b63e5d78e57dfa01b75b68d998dcbc4baee5c947c9393f52bacb1bc5a95d44cac7fe558dcd60cae37733720d3288ea4f41c5ec7fae7c8c506c805042ce
-
SSDEEP
3072:Svz2fkOzN8EwyfkMY+BES09JXAnyrZalI+YQ:Sb8VtsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 4268 msedge.exe 4268 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4268 msedge.exe 4268 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4268 wrote to memory of 1280 4268 msedge.exe 81 PID 4268 wrote to memory of 1280 4268 msedge.exe 81 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 4808 4268 msedge.exe 82 PID 4268 wrote to memory of 2976 4268 msedge.exe 83 PID 4268 wrote to memory of 2976 4268 msedge.exe 83 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84 PID 4268 wrote to memory of 512 4268 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc66746f8,0x7fffc6674708,0x7fffc66747182⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8772409343165177687,496018355993319010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3392
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
6KB
MD5131c78f0be9b8020d9fe9c64bf5293f8
SHA19cfdf0561073a1fb4e7c5e152c1acb3cb89f77b2
SHA256040a3ed30a2551606f61ba8d84602d20acb4327c1e67e1256ac8a7b4aab08048
SHA51210de48620dabc2e253e1936c9c07a36be99287d09307ea34115fa2ef06f8bea0193dd85fc1c481adbeb06dc1940522cc0acdf5919d980a1d2c33e95931c55d55
-
Filesize
6KB
MD5cd4dc121f063f508e02b45144795a566
SHA1e10ca3085c5ca621a1ffd23f89a028e29b05139f
SHA256a55dfec2f4649d088f0cad1cad2e64c6aeec163f8057794c70a6e349d9d0191f
SHA512641c81006a74311024b22e6841d839a511acc678281573f8d3cf2ec4601139b17565ad53d8e6f18aed556afaa32638d1f1d3d705cbaf20300d2aa72a32567960
-
Filesize
11KB
MD5d287133caa118b143a1992a21f61f093
SHA1a4147530d19f1696012cc9a77ba7e04a8886fe16
SHA256e592918342c5e0a7e37bd7faa7ba5da1ce4be5f14f291041293ad2a63e60e8e0
SHA512de37385afc6a5a31973602c6bb6b75ac2a583c034e4cdaacbf62dd8f25ae144d1b20860df5b286b65bce8605a09eab82404a90c460bd9f5b4abcb4cd5b43336e