Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
LOwlP7.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
LOwlP7.html
Resource
win10v2004-20240709-en
General
-
Target
LOwlP7.html
-
Size
1KB
-
MD5
0961eb13ef799b1c1f2a335965f343bd
-
SHA1
5d7ce0e0c0137d85da4d7ced88bff2bdba80ed20
-
SHA256
8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435
-
SHA512
554458650ceec6f091e6451ed3eb46141d98deba5cab9fc54c0b956b90939caf5d846edc6ae4d368d88a964c2259f5cf9fcadc8f7e610b30928ea65af9b5c777
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2876 msedge.exe 2876 msedge.exe 1852 msedge.exe 1852 msedge.exe 4184 identity_helper.exe 4184 identity_helper.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2516 1852 msedge.exe 83 PID 1852 wrote to memory of 2516 1852 msedge.exe 83 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 1944 1852 msedge.exe 85 PID 1852 wrote to memory of 2876 1852 msedge.exe 86 PID 1852 wrote to memory of 2876 1852 msedge.exe 86 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87 PID 1852 wrote to memory of 3288 1852 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LOwlP7.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadc5c46f8,0x7ffadc5c4708,0x7ffadc5c47182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8718028405100634520,2917746974934907756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1408
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA169ad27d9b4502630728f98917f67307e9dd12a30
SHA256578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
SHA5120e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
-
Filesize
152B
MD554f1b76300ce15e44e5cc1a3947f5ca9
SHA1c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA25643dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
SHA512ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
-
Filesize
6KB
MD59e323e3fefbde90ebb1232be3adc6a1f
SHA142a64c9d96ae813a10b7d92933268f43a8e986c0
SHA2567bec05838102a0d8f6483efa7554369b18ffd992c3d4ec8d5c0f4995156513e6
SHA512ba31f08d2094d4f23a3576f37c9d511bc18a2bfb9d6fc9c25c2417215b80efae3104fce2cef576f729e57eb750957293b5ec7fa69ad3af7bf5b00fe198d83d2b
-
Filesize
6KB
MD5162a44c658f09057305ca78695f209fa
SHA14e73c39db9e1df0757a14f15571b24037752a4ba
SHA256b9bc89c65d8ce166317e17b8a7d54c4831101545e2e5ed726355dda23475f98d
SHA5122689f1f6dc79a50e237d1672e3d8ce6071ac52efc0cfe3b50c7ff74c5106e33253fef9b4c4aebcb1bd1f8687bb92d28480b4a3c43b3d0f0f0f402eb59bd4baa0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5df23a7f9d58833645f963755485efcbb
SHA158a2b159a8c205f9e6798425342998ea5295d5a9
SHA256debaca07a7c778f6715b45d28e68901681c50cd5c467ad645651a07cab612dca
SHA51271306ca3c49e329284f46b51c83c9b6d5d530e1ce2a8bd0a341aed288bb03b358e3dbc0af1a8985030139cc3f4fc28eecb6d97dcac7062beacc62cc202fe7849