Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
c868444679.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c868444679.html
Resource
win10v2004-20240426-en
General
-
Target
c868444679.html
-
Size
9KB
-
MD5
4a20f570105222203ecb3202145cbfe5
-
SHA1
2de01f566fab3cb462609acd8f1a0b72bd14c53b
-
SHA256
0c645dd01b7fceeecf6be5a13c7251ec31d9c0c27dcfab610878574aac8050a7
-
SHA512
4c1f8714685bd220353110be3addc7e8879afec9eeb0367433370542f06eece794725f9e860d90570f5633cf4ea6567357b9834958ecd144138a71561d2bac01
-
SSDEEP
192:OxqEJZD64uPpB2m03tK4U2ZMCTDbzaCK9Xt9yvegPHgoC2d9Z66:OpUpB2f3tKMMCTDbzaCOyvz
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1884 msedge.exe 1884 msedge.exe 1636 msedge.exe 1636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1636 msedge.exe 1636 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2244 1636 msedge.exe 81 PID 1636 wrote to memory of 2244 1636 msedge.exe 81 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1832 1636 msedge.exe 82 PID 1636 wrote to memory of 1884 1636 msedge.exe 83 PID 1636 wrote to memory of 1884 1636 msedge.exe 83 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84 PID 1636 wrote to memory of 992 1636 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c868444679.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb47182⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12812621867879226995,1855864842780496957,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12812621867879226995,1855864842780496957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12812621867879226995,1855864842780496957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12812621867879226995,1855864842780496957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12812621867879226995,1855864842780496957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3120
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD55125fc7efb44586c4ad8d8a29b2bce47
SHA1b0ceeea5c61e27c41f5208cd828043f7c0abe011
SHA256ab99d4a2bfc0462ecdc9eb216924c79f24b196e6fae08d0f1761e228a0d3df27
SHA512c56751f505ebe9dcd204f3bce66fa8d0c756eda9575f49bd10f6c6f1594e03db20059c9702c080f64ab15b7430ed3572158ea8746d3ec4631dfbf24d9bd097fd
-
Filesize
6KB
MD5753c33f3782cb409dd512471c8c8eef1
SHA1a2044611647ac901ef6b6a7cb563c53c0efb2e37
SHA25685e823c2eed14a3d976c9bf1ef81aa0158f41d62d8116909d5e1783e85c029de
SHA512a53e6db86874a96a28dc49275a49decf78d203e2e68464741daf97b2dd046ffb05674b0167d6b29aae2e29a951b7a075a3b0bd1999944ff2ece15968eda1d488
-
Filesize
10KB
MD5ba2a4ea320c2ac73a60d8811d9abe402
SHA16fa92b8228f453594f4e254741fd56a22e1abade
SHA256a28378f32ca72c7e6d5448ce876636c7c0378ae174390ef19a985ca162b4e593
SHA5129e1b44a2ab7b70366b9d0888f0a8139494ba04bc7711b8692d18ecf3230b71bb8677475bc0b8a978c452824b0da561d91caccd890041c7c4b22e3bcf7170add1