Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
5Static
static
1attachment (2).eml
windows7-x64
5attachment (2).eml
windows10-2004-x64
3022-CITACI...02.svg
windows7-x64
3022-CITACI...02.svg
windows10-2004-x64
3IMAGEN 3.png
windows7-x64
1IMAGEN 3.png
windows10-2004-x64
3email-html-2.html
windows7-x64
3email-html-2.html
windows10-2004-x64
3email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
attachment (2).eml
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
attachment (2).eml
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
022-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-02.svg
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
022-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-02.svg
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
IMAGEN 3.png
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
IMAGEN 3.png
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
email-html-2.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
email-plain-1.txt
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
email-plain-1.txt
Resource
win10v2004-20240704-en
General
-
Target
email-html-2.html
-
Size
3KB
-
MD5
96abfee52a7a9b50c00703a99d291558
-
SHA1
c5c9440bcbb8a3d58c90f6876a7226ccf257aefc
-
SHA256
47468c80022a96232fe2ce21934e686eba99ebbec3adaf9c7fa4fdfd78c488c4
-
SHA512
89be6c5903e8fc5f16e76b3de2ca3e865defb91e1e08d6253d73dd0ce41c915ed0f659a106d88ddf9eab7e54f760bb562561f1a88463c2a4a9d52f5a156b6636
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4972 msedge.exe 4972 msedge.exe 988 msedge.exe 988 msedge.exe 4540 identity_helper.exe 4540 identity_helper.exe 2952 msedge.exe 2952 msedge.exe 2952 msedge.exe 2952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe 988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 988 wrote to memory of 3344 988 msedge.exe 84 PID 988 wrote to memory of 3344 988 msedge.exe 84 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4560 988 msedge.exe 85 PID 988 wrote to memory of 4972 988 msedge.exe 86 PID 988 wrote to memory of 4972 988 msedge.exe 86 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87 PID 988 wrote to memory of 4792 988 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7ff95f8f46f8,0x7ff95f8f4708,0x7ff95f8f47182⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵PID:984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4771376091880076868,13671015019261919397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4820
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
Filesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
Filesize
6KB
MD5e8de0a5a71d3d0533a33cf73c0fbff29
SHA1e3e9e8cab336c1b49fe35ef0d5868a3c4e052e71
SHA256d236196030ca2b5bd3a5d2689bd913fe3473179516a23ae056395f0424072093
SHA512f2085d83b656f8d4296bf25394e88f6735783b5e1abda4e9bb4ee988adae9d1696cfd02bf68c12a5bb41632efe707ffabe13f0d641425c0ce2e17d9a5dd9b99d
-
Filesize
5KB
MD532f26801a9a559424f9b78fed9c8ae42
SHA1fdc9dc3a8c0d45108e1f1af0057b6b04461791e3
SHA256e5b57c05828ed33530a93233d335dcb35af0c5283f84e268647ae6f6cee197fc
SHA51239ba71f95a36d628b7f3510297df7ecc52cd76d1eef9b8702ecf7bce2849d26a7562d1ca3492b97a3ca9130fb5add3c863cf3a0a2fb880601889c80c6cbd9ef6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD574e3ffb9f762ec9bcaab7c6d67580708
SHA132916d5ae57d2a533ccb4aa98e7aaad910a7edb3
SHA256fe50034e6f52f2121082ae473ec8bf1305f75b6a4f38ef875d45577e8c2b55a6
SHA51273dccb1006c55bf36aa5179086446b022762bc11fec12fd5771f5d69c6612d0887e199d9fe697776348b0a116c6192e908872fcf5b8779a6b4b39191e181cdcd