Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
redirect.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
redirect.html
Resource
win10v2004-20240802-en
General
-
Target
redirect.html
-
Size
6KB
-
MD5
b191003e2c9edd1ff19d1d2d4a1c9566
-
SHA1
ff6c82802b464f3c787666bbead5a8f2ae209a5b
-
SHA256
b1827785ac1192f4bf06a13f6db8c6d3546bf8c85af9124cd051db8da6ee28d9
-
SHA512
b41314fa8cb44da7efd54c590d457684faa099700c4cc251134013b67351bf8320f8ab92cb180c29d3cd737560c3d9308c7853475fb3ec408cb757adde6dd21c
-
SSDEEP
192:dDHLxX7777/77QF7Uyrt0Lod4BYCIknOzXRdGG:dDr5HYh0+CIknOzXRV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3696 msedge.exe 3696 msedge.exe 4884 msedge.exe 4884 msedge.exe 4772 identity_helper.exe 4772 identity_helper.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2908 4884 msedge.exe 86 PID 4884 wrote to memory of 2908 4884 msedge.exe 86 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 2960 4884 msedge.exe 87 PID 4884 wrote to memory of 3696 4884 msedge.exe 88 PID 4884 wrote to memory of 3696 4884 msedge.exe 88 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89 PID 4884 wrote to memory of 4236 4884 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd747182⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:82⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,11098046727148240373,3558485995769123629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
587B
MD582c269b0fdfd8b84dc2ff3b9582cb4c5
SHA12228e09f10024cf3d7715735ec28c907c798df6a
SHA2569cfbec5f43b9ed6a3a987d36c07063e95b584ae2e6c90dfd6a2e03af864c033e
SHA5128310af3f2efe6ef64552ee6ff959b6369df42b01035557a3cb0493e1b54306dca176d62165639ace720c24c0b54381152829d4d1618794f828d33c57894abcc8
-
Filesize
6KB
MD553ba301f3a92742f45d5f0821df73504
SHA1f3b877249080ce70cd28f5c4e0251a2ac9786815
SHA2567d86d3240416c161fb4cf40841aea041ae723d94225d8047d51d2578d082dc67
SHA5126a2717505e9b323203526b0767790776eece598ccd07cadb0e50e904cc9f1824451ec2f5b66a41e319f31fc76559bd572d9be9643fe272ded42d562d2d1d5890
-
Filesize
6KB
MD59695df6ab8bdf6038ba5e19c94c6d73c
SHA169a435f10dbdd97b135a69dd01af66a146c68cb5
SHA25631832bd54b1ff577d921842a2a48efb014686caf713f6308d74958476edb9f5e
SHA5122de5f145866010cfe3354b4decfd322e3bc3a3add3a2d8228ff0f3eecc9eb81d879eaef767c188b719abdeb70ced1355967897ffd56ea26863a2d791abbbcb8b
-
Filesize
6KB
MD53cb16986f8867ce07056e46f22b5309a
SHA1853cb1d2f78e5c4b442bcac96917afc232f10a4d
SHA2567d3f0f55e3a5247e47198955fb09278fd0103fc06e9037c065ec9a23a0487464
SHA5124d1bc5bfbb1386a21996e9b3e62dda44e2196ddb24aa944cf6ea60cd4def76980f0631e915c795daed06a841e000a5cfa3af3b1c6d6c79ffe66320aca26fb237
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e2d068e67e66ae2e32e57e5d2d6d56c9
SHA1b6348070b7702016009a0a8ed37ed923fd164e50
SHA25630b26892b8f9378be2972daae921992fa8ee1475efb6c0fbb837593578f02306
SHA512bae90c6af450440bf5fc1a7f8f70d5dc90f406b29b81cc549c38b939364b49e894eccbe69534d0c9861d96c8b03575ee3eb91afcc6bbe82a21f2859835fac170