Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1681s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
sample.html
Resource
win11-20240704-en
General
-
Target
sample.html
-
Size
19KB
-
MD5
24ff8837881db8f652db816caa0529be
-
SHA1
6df039eda2c7586a4ab18ead37508ca9d24176df
-
SHA256
45bd89a2472835f6173fa068bad4a9a4c8cf72387025b923be7321bdc3c0c55d
-
SHA512
9a6685c9c11e3fb6643f5b0fbfb3db2a68f44c52e5714498179314d01196a4941bca265c8890dfa5011a5e5440f147080517777ca97249e3473835fcf3c4e502
-
SSDEEP
384:6HXisspY1ocy4+4lbGagBvhpNoIe8A1S2m0i3Y06Ib3nfm1xCejiw:K91ocy49Ea8JpNBev3i3Y06O3fYxPiw
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3532 msedge.exe 3532 msedge.exe 208 identity_helper.exe 208 identity_helper.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2172 3532 msedge.exe 82 PID 3532 wrote to memory of 2172 3532 msedge.exe 82 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 1988 3532 msedge.exe 84 PID 3532 wrote to memory of 3260 3532 msedge.exe 85 PID 3532 wrote to memory of 3260 3532 msedge.exe 85 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86 PID 3532 wrote to memory of 1084 3532 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff851c746f8,0x7ff851c74708,0x7ff851c747182⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15245479544290288726,2916133200719571882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1852
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a27d8876d0de41d0d8ddfdc4f6fd4b15
SHA111f126f8b8bb7b63217f3525c20080f9e969eff3
SHA256d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe
SHA5128298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c
-
Filesize
152B
MD5f060e9a30a0dde4f5e3e80ae94cc7e8e
SHA13c0cc8c3a62c00d7210bb2c8f3748aec89009d17
SHA256c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79
SHA512af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD58339a7ad644fe5fb328f93e1f4de54db
SHA18439643aeb8777036b919585b68e54e412dd7abd
SHA256e36a2a988914522eda61f051c2aa399cc4c5c7945d375ef0a153114c6eb9a560
SHA51234225caf37349271f59eb36a29dbdb26232e463a777e48de7e88c3785c18f216d7eab1071e4d0ce00136dec6f112c345f08136832a18b471f7e205d48dfeb5a1
-
Filesize
6KB
MD5561ccc0b9b2f0c0298c35f286f3c3651
SHA1aa3fbdc6658c234a7a0794188d5bff28ada6a8d7
SHA2561f7cd7fde48e3a5cd340ac0f4e7fe0b2d9bb0f496589acd0a4179ccf18ec3abe
SHA512bdf0f6008f0ad9eead40a35d28d2dbfc564a47e61934e8f0251fd4ff356eec81eb72c984ba2807f9082b65975b7f7b43bd9986ecd00450840ec4a1d4693cc17c
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5c14da8998d6aec7da8828667c0117f65
SHA18260f693efdbcc904d285dd27a0dcb0841da38d0
SHA256ade8b68232104efb788352a99f512d5d69e3168fdbfaf140170752a594e47073
SHA5126b8e26f384146a6279f0910332f4902a82a6b733aecaacf83675e087fb74b3294936da3219ed9a3921cdfea5b1b667bc3ae267a7dda681f4762c992cd7f3985f