Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
fb36fbb393b0397b384b86810c868013
-
SHA1
65d387930ce28f086a3f64a6a6abdab7cb9e08df
-
SHA256
072ac5ac8c16eb13c34c9ddcd945fac92441e66cd3c7cf1ae0f5c540e3f367f7
-
SHA512
6eb88a454ddd4985f2e3df06e05dedd15aa897d135888e1774de5974f461058dcc263cb15cec4be402e43b60b64436ac24a38bc203c988f2646e70e229fdabaa
-
SSDEEP
3072:StuA2dYfuwpjjyfkMY+BES09JXAnyrZalI+YQ:StjfGsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2464 msedge.exe 2464 msedge.exe 3596 msedge.exe 3596 msedge.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 4092 3596 msedge.exe 85 PID 3596 wrote to memory of 4092 3596 msedge.exe 85 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 1632 3596 msedge.exe 86 PID 3596 wrote to memory of 2464 3596 msedge.exe 87 PID 3596 wrote to memory of 2464 3596 msedge.exe 87 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88 PID 3596 wrote to memory of 2460 3596 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e347182⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:12⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9160437667118179906,134105135231299183,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5b38eca2d573359a919f6fa94322d5283
SHA13c534a0b3208b1ee5ed61e4a59d604ea5a81fb04
SHA256b2b050bd78941eb829eb074fd13e30ae8a5309734be4eec80dda767f11cd48cf
SHA512b982ddc9c887ba40fe2e1a8e7b0d02c4d9c5228df1945115445bf7ebaaa79701a4207fb3e9b1b0debc5970500febe99c9a8a6830dd206ad17aedc7e9158ae467
-
Filesize
6KB
MD58c805b118dfab0f49023d3d89c33dcf5
SHA16955ac266365f1e123d3f3e190344ec429c376b9
SHA256d6540eb26bebdfe35c3042937ce60c6abf483a38f390250d9d3ce8fd1326258d
SHA512a9fb4c7c52569c36cb417470a9e49bed78086c56c96551063170c24e9425384ac6f618c8ed47e7c463fc2a457f4b80ec3a74d12e244235d300dab8f0b6ee0b7b
-
Filesize
11KB
MD5d41db0b7657ab6898c14ae52eebdba1a
SHA1cb54c87c24a7c1255158f04fffc68804a4efff2e
SHA256bcd689975176bb82bb0295053a3251b7dfe06c1d366df01b76e144283f273cf8
SHA512273f59d947b1d3eb0f185e8cd6cc037841507f5abd462bd460d88e857e75d077fa0f0b96c53f438aa3f23763a2901d7a089e0e8848092366903c43bb20ea6229