Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
51ce1e5ff8a6d73a22fe1ca65e0fa935
-
SHA1
2f7cba20f6e8fc21c9b4a049971bf0b857ad980c
-
SHA256
0362036f74fbeb27d0229bfeb93a3feece2e5678e31bbd6fa474be7549b8444d
-
SHA512
2d3fcc748ab5e16951804d2259ccacfae7ec98c8c9cb9d38be95b141c0bbb0b6d9f87429e4ca7b6c8fe2d78e0c1a6cabb5ddbe50fe86c0b58e21f4d61dbbf013
-
SSDEEP
3072:Sa3Fhd0cffZpyfkMY+BES09JXAnyrZalI+YQ:S+GgMsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 720 msedge.exe 720 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 720 msedge.exe 720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 720 wrote to memory of 2404 720 msedge.exe 84 PID 720 wrote to memory of 2404 720 msedge.exe 84 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2696 720 msedge.exe 85 PID 720 wrote to memory of 2268 720 msedge.exe 86 PID 720 wrote to memory of 2268 720 msedge.exe 86 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87 PID 720 wrote to memory of 2076 720 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f8b46f8,0x7ff85f8b4708,0x7ff85f8b47182⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,15554429294554067171,9741046545920813437,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
5KB
MD5d81e8bb92dcd7a1b895ecf78f6b210f0
SHA1499df1e6be6e74fec94e2a0098caf2849c700dc1
SHA25623f8b0534b529e8f0296863179b5feb2f0c750dc8ff99d99c92d9d1d8bd9a2cc
SHA51242bde00c73b1d37c7fb7ea60989f68825b5987e7172ff6fae17003880bf4d2f53f1f221ec2da938f01bf21583c8940a134e983784955c9ff391c0abdd104638e
-
Filesize
6KB
MD50d2cfd0541c2bc951f790892049e28e3
SHA19519223775de5bfffa7a43e35e2b33b66cdb25f8
SHA256385bf9078b45a2c1e1151d7fdaeac3a1d518a0306775ca251618ecc107ad69a0
SHA51259bc85336e3aed781b6e21d6dbb7fa7cfcaeccc6c125c5fe77c30688602bbfb4b679e89b5b5855ebc3efb101f03a2a13ac3047660b64ddc43935e030ab51f6d3
-
Filesize
10KB
MD5e44a9534d159b2364cd67aa19cac69e5
SHA1a64e0670b8fcc5885393a949745e79f93e840eba
SHA25641ae44a90f4f93826066ed37deea2612fb2f29424b7a91f94d3258014f354d19
SHA512e869c6de6af85eacd3cf509c6323e095255b76e51b5dd7bc8dcc705090330b3bf8761e03d41185097b6e6475a10d37f3731bf80b9a53cadf673f7ecd92b95ccf