Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3DungeOfDestiny.exe
windows7-x64
7DungeOfDestiny.exe
windows10-2004-x64
9$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
9d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
DungeOfDestiny.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
DungeOfDestiny.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240708-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win7-20240704-en
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
vk_swiftshader.dll
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
vulkan-1.dll
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
vulkan-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240708-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240709-en
General
-
Target
LICENSES.chromium.html
-
Size
8.4MB
-
MD5
e400cd908b8fb7c13985e2f5cc7a7044
-
SHA1
bbafebdf5b067a7d7da130025851eaa52ec3c9d7
-
SHA256
ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
-
SHA512
e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
-
SSDEEP
24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4824 msedge.exe 4824 msedge.exe 1412 msedge.exe 1412 msedge.exe 2132 identity_helper.exe 2132 identity_helper.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4920 1412 msedge.exe 86 PID 1412 wrote to memory of 4920 1412 msedge.exe 86 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 2812 1412 msedge.exe 89 PID 1412 wrote to memory of 4824 1412 msedge.exe 90 PID 1412 wrote to memory of 4824 1412 msedge.exe 90 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91 PID 1412 wrote to memory of 4656 1412 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc54a146f8,0x7ffc54a14708,0x7ffc54a147182⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:82⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,12024213790593042158,16508240207779885096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4352 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bafce9e4c53a0cb85310891b6b21791b
SHA15d70027cc137a7cbb38f5801b15fd97b05e89ee2
SHA25671fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
SHA512c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
-
Filesize
152B
MD5a499254d6b5d91f97eb7a86e5f8ca573
SHA103dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
SHA256fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
SHA512d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
-
Filesize
5KB
MD5ecf6ea23a044e56c0a38b7c9b0da0ebb
SHA19030e7078e6c4b58255323288e51814d263983c1
SHA2568c4d58c1a544b3299a46be5f86c130cecc77abbc4e096e99064ffd46fe464310
SHA512e7d9229d5a01cd31b82d3ae8255500d4c2c9b01521235e4a184d3314f0fb6421c149d78d3929bdbef5b22792543abc756ba6ac345724a36229f99c399730a29d
-
Filesize
6KB
MD5bd3b4038f533f7c2c6e1dccd9f5fc72d
SHA16ddfe7640e09a22c122fde5ebf4fe0b6f7a90fd8
SHA256fcb810882b3cfd8ec6a2a5d2f610b8b4078efe85a50efd241a61769ee9570aff
SHA512b8a74c88a0dd8925b959ddbcc150a604fe107bf57611623f5c3fc046bca0b0c499df1314c688c041c4b33122e311fe7bb4b9e663b17bb6d7443f1c88c774140a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bbe8e2afe524ccd04c3840323351cbbd
SHA12f9878342c28ff83373f95f3622703d1f998ab9b
SHA256fb9c202f6fe0a9dc6f05f9ee8efabd969726d2ab34c922b61a74809c1836183d
SHA512e6b3ed32447bd85066aa9510671b37f0a3b993105b16633c365a531b95f0aa771aa9ded02172617bb16f1086ae41ab723f97bad71c98e5bf8357cf6ab4ed48a7