Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
cf6b53fd85efe3d8ad1aa3e4a9500497
-
SHA1
facf6c3a6155bae5f75419f4e5aed4b93dcc4186
-
SHA256
0743c0f8458c3fe7ef2f20cbf7ed5ac473156e690036198315fe9510b028a0ce
-
SHA512
9a0ab011612eef899174723018e7a2f80a2dfe956c9739f43023bb3cbcb995708c593fa4a763ccfe2ed2f4c386474be6627dfb65a7ac0aec88b20a10fcdcb39b
-
SSDEEP
3072:Sey4YbLEiAbXgyfkMY+BES09JXAnyrZalI+YQ:SeEQdsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1292 msedge.exe 1292 msedge.exe 400 msedge.exe 400 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 400 msedge.exe 400 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe 400 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 4464 400 msedge.exe 84 PID 400 wrote to memory of 4464 400 msedge.exe 84 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1452 400 msedge.exe 85 PID 400 wrote to memory of 1292 400 msedge.exe 86 PID 400 wrote to memory of 1292 400 msedge.exe 86 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87 PID 400 wrote to memory of 4188 400 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd490846f8,0x7ffd49084708,0x7ffd490847182⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4336361299095298429,8592786638215955821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
5KB
MD5bc444b44bfa1a01c024ddbc731be7a4b
SHA1d9bfc50e09798009edc0f24f7e575b0ad9ebde73
SHA2561a5894f3f0103d5c400a8b4617e3962972269ec8342ab106e432dd170a229e1d
SHA512493a48c448290a4616f3643809d0058e95ba372852fc197a68fe55a5f1475d5110b4eee33771a5ebbd9c1bca3d87262874b6ef581a540e4c95624e3a460b0091
-
Filesize
6KB
MD55cb5d6266a65d2102d841ee2dcd461e4
SHA1a617f12abd873c7bf7bb9cca7fcf54f82d761b0a
SHA256108da5ffe1a6bb2ed23b38948807647f0d9890ef240afff36ad98eb4c240beb3
SHA5122be2513416f5e91a07bd99c02ed8d26e442539c68455a6a6790e65373aac34f3fa7e8cd793ae9ce649d4dd486f3d98730ca23528a861d673784c6cdd9364bca3
-
Filesize
10KB
MD5bb9db123fae3029f3937bf42cd73ee03
SHA13bae1d70fa1d295a0107d92623a904f346dcf3e3
SHA2567e1a00955a470128d98b5260a303a8e45a1eee098039e3922d4ccf911f026c95
SHA512cee36730cc2df3561ba71c32e7369f69950712b28015d3557bed080061aa609c0a41de11f7687be624323301b3e6954672b3b6537516edb464280de40737a71b