Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
24b9428f38fab6e52628e3b238082785
-
SHA1
978a8ccb6855becad46ac04db01313c57aa06e99
-
SHA256
4f3821fc5168653e825cf3f1b9b90b5ca9381ca579cc35e31672a935e1277be2
-
SHA512
875dc359d0e11e9ec271ecfa4a1f5aa7e79c15c0739e8c22e5cafa95cc138400f86c24216a106c2858d720cbe982ae905c5b8235664d463f2d5a86f414d0c8b8
-
SSDEEP
3072:S/qI+2ZrKUW9+xkyHyfkMY+BES09JXAnyrZalI+YQ:SSP2ZPWAVSsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1172 msedge.exe 1172 msedge.exe 4108 msedge.exe 4108 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4108 msedge.exe 4108 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4108 wrote to memory of 3092 4108 msedge.exe 81 PID 4108 wrote to memory of 3092 4108 msedge.exe 81 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 3220 4108 msedge.exe 82 PID 4108 wrote to memory of 1172 4108 msedge.exe 83 PID 4108 wrote to memory of 1172 4108 msedge.exe 83 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84 PID 4108 wrote to memory of 2636 4108 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f56546f8,0x7ff8f5654708,0x7ff8f56547182⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:22⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:2636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3091528380414973133,4077864023073652210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2624 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70b8f9d7-a934-4a32-9ca7-db8bc2cb80ec.tmp
Filesize6KB
MD57b19668365d8eb75c6d183d2fd3bc0a2
SHA1ac85562b1430490d50ed9092adbf51542b172095
SHA256133ea91fed312e9fc8b0c60cf78f03ce35ea8391715a75b60eb1e8e1674556dd
SHA51232b34d8239a51e284dc78a9b3b0d8ebaad12ba93966557865f6e4d6d82c989ef878b8288de5cd23063003c7b2b10af96212ad880851eace5c6e9bdcb98edc48b
-
Filesize
5KB
MD5b0ead36e32192cd85479891a95a3dd70
SHA12a0f6a3db0bd44bd29e2c7c275cbdafbb54ad5fb
SHA256e9ac15091ac1d0af281972a651982917743e3f900685459e52cad9a9e72f0f35
SHA5128fbdefc88e161ee05690b6e7c7f47f74553fd7795f87c5769b02f3494c23ecbf83c7d501a47856ece07a218e91d71246be812d6c566e0da867fa68d6e30cebe7
-
Filesize
10KB
MD551806ef5d3c89cde9b3871c52cf65026
SHA1be4eb44996747ccf8836e5d7c3423a9c4bbb8389
SHA256fbcc585609c3ffba5049748ddbb1dd806b870abb077ed2afb37a3285d077a88c
SHA512e368d71932f5645b1d93ca028cb6ae69042632c4e65c018e46e54b08606e436e3d471f83fe404c50e0088ed6ba80c6c02285ef5a97807ef40ee34cde1ff24ab8