Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
76s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/08/2024, 20:54
Static task
static1
General
-
Target
error.js
-
Size
36KB
-
MD5
7e2eef2e2adaf13a5d6d75e7d9e21023
-
SHA1
56ff3d47f47dd105bea6b96f55d1e5d29c0342fd
-
SHA256
b0b8958551da5a48b48152832a43e05eb568b49d03a5936ca5cd6ef609c85c90
-
SHA512
ccd6a73624b22967d86d6d0004f029d73542b53bb4e9ddcd05c31d992598cb591a013c9105cf4c0e47fd0e84525bfe557ec32ba1d607c8b6db5d0da944e0e499
-
SSDEEP
768:wCqO/gSecur8rddY4sQ0VskVMIWwC+36x/Y:wRO/gSeOq4mvMIdFKx/Y
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 6008 msedge.exe 6008 msedge.exe 3088 msedge.exe 3088 msedge.exe 3988 identity_helper.exe 3988 identity_helper.exe 640 msedge.exe 640 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3088 wrote to memory of 4652 3088 msedge.exe 92 PID 3088 wrote to memory of 4652 3088 msedge.exe 92 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 1468 3088 msedge.exe 93 PID 3088 wrote to memory of 6008 3088 msedge.exe 94 PID 3088 wrote to memory of 6008 3088 msedge.exe 94 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95 PID 3088 wrote to memory of 4660 3088 msedge.exe 95
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\error.js1⤵PID:4232
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffcf673cb8,0x7fffcf673cc8,0x7fffcf673cd82⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:82⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:5532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,14439716482161629022,8364870071342990664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:3960
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e681bda746d695b173a54033103efa8
SHA1ae07be487e65914bb068174b99660fb8deb11a1d
SHA256fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
SHA5120f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
-
Filesize
152B
MD59f081a02d8bbd5d800828ed8c769f5d9
SHA1978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA256a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
SHA5127f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
-
Filesize
6KB
MD5c8ce6c4abb788ea3493d7aa7922d98cd
SHA14411c78d37225e051a62ae79e0c9b42ff4f195e9
SHA25608ae0ac69cfca97dfa9511aef7d00651971fcda7381a944f9d092b9359453d34
SHA5129f41f4990969836aa9b2a82511fe44c26eaecfcfb574de288c4e0e848c75c4a86e74190eea9585887a88865bd321be3572f341d9b39413f92c75cfac8baf167e
-
Filesize
5KB
MD51f981f2f5e17b32b65b80dad8be453cf
SHA1c74bc63eecc4e2110c729e5ba7d711df7a69e964
SHA2561428072c9749a9e034d8fc63a2de4aa4aecc9cc820f663e305ffbee40245de94
SHA5124d67668ec4d421a5d7392daf199a31d053144c33c32b75a3005cee0a03ccbc1ead56089e6a01b96ebe23861a479b98f180485fd13cc40ee96fbb3e904befd01f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5b2a7d6120db9219749d99e99cb2dc2ca
SHA131c8838239e292313a4605027aad589b1d45f4a0
SHA2569094b0bc4e95dc3fa488605319b73eabe143bb6ffd76909fc747c8b1cfb8f393
SHA512a67ac63f258cd4a36fdb44074f5812f0eaf0f94718207671372a4a26e39a3933421a62c845b9bc3448e9c924df71688e7b07552b1e08fd90769bbb452b0b7a73