Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
4074a221a1f76ef8af6ac612fd3dcce5
-
SHA1
cce4315ea76a83c01fd1bc1b9aed35b3033d48a9
-
SHA256
f5b635dd2abe13b0a1341a01a1d836a2212100fe2a7eba7a0e25c29a2d8c658c
-
SHA512
fc332550185a7403c292625a8781310a8e8154b4a8082dba078770e2aaab474e105d70521df364dfbcdba05971a6c6f9c9cf1cf12ba80c92b474e44091c91eff
-
SSDEEP
3072:SMtqHTdKbTMIibZLgUV6AoyfkMY+BES09JXAnyrZalI+YQ:SMtqHJKPMFtLgRWsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 1988 msedge.exe 1988 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 4792 1988 msedge.exe 82 PID 1988 wrote to memory of 4792 1988 msedge.exe 82 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 1676 1988 msedge.exe 83 PID 1988 wrote to memory of 3452 1988 msedge.exe 84 PID 1988 wrote to memory of 3452 1988 msedge.exe 84 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85 PID 1988 wrote to memory of 2744 1988 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa970046f8,0x7ffa97004708,0x7ffa970047182⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11839864858264526691,9341501429328753226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3764
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
6KB
MD54df44338c688cbd9639d7f2181caaa80
SHA171659047875d65d5dbcdc4fe6c46865a26aee084
SHA256270ca33ca6c2e6672cd69d2f6bbf42d3ebb44807d82a5132dabb1ecf3e733f2d
SHA51266d06569b222501aad257307de67e5dfe15b8625139dc960278e7b106e12548fd6c1966e9e710ed2b4fc5fd85ebafac3477491aafb8acc12180723b430d654e1
-
Filesize
5KB
MD51f2c7e0e1848657daad76237bef57ce8
SHA186bf8906131d0f8feae03858e5b50b91e38986ec
SHA256ced4fc761d2e81420c8ad01c8311c481d7f2cf7dbb234863fb60c74830c595de
SHA512590423e8d3493e13df71efd5110504f8c595b94660529b3634513191a82df35d9aec6d7daafa9957cc46ea04d325b95405a681b9cb451aee97c50b120f4e623a
-
Filesize
11KB
MD5caf3089cb6feec8dfc971bae206addce
SHA19a046ec86b25527e6223a40bdf527c5cb83db3be
SHA2564f1f2e1338478f78e51a5aa8612f42e37ccb16b6dd24efa9f115774802c82e1b
SHA512df778e603990a93451f6ea482c8b1c5180b31313eaddab927665ea930aea76968ceddb0c3fd8d2291346a2779e6e7b0fd57a4c01909fb22a9c037f8a14b019db