Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
sIoHCCoA.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sIoHCCoA.html
Resource
win10v2004-20240802-en
General
-
Target
sIoHCCoA.html
-
Size
2KB
-
MD5
28296920fe399bacabe420a8039b08f4
-
SHA1
0a809de2aaa04e64dbe5f36df795b486ddc90887
-
SHA256
3535bbb33392ca71ec753c10da7c27480c696b540e4fa4c81375b0b5a51a57f8
-
SHA512
c7e7957f08f63fcad9ee08c0d0be092db0cee67c022c14ffb230fa34d2a836779334bc9e88642d6ff51c251fb5a6c1717aae8fef2dad1a8ba718d528a4f4ab9b
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3988 msedge.exe 3988 msedge.exe 656 msedge.exe 656 msedge.exe 4080 identity_helper.exe 4080 identity_helper.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 656 wrote to memory of 2972 656 msedge.exe 84 PID 656 wrote to memory of 2972 656 msedge.exe 84 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 4164 656 msedge.exe 85 PID 656 wrote to memory of 3988 656 msedge.exe 86 PID 656 wrote to memory of 3988 656 msedge.exe 86 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87 PID 656 wrote to memory of 3808 656 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sIoHCCoA.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee3947182⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10431966493546403062,11207013797463140872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
6KB
MD52636026c26776b81e0d181513b7a390d
SHA158202a1c4e257d8c71c4e61c9045fd5bfe9090b6
SHA256e6d33e2e4a9025a78e7cada53aba7377be9c31a0a6c6cb274c127830fb0b2615
SHA5123a334e5a668fb092044ad0c2d09cf5138b10883bd79ab3aa98b150ea31c03e2c3bc0d5f8c2a7e4bd49a8800ece9e8b8a35b0c6dcc0ee72523557146aac986e3a
-
Filesize
5KB
MD5df4300d59b394b1b9197240387123ec0
SHA1c9af78989896fc108c0e969dec4aacf11115504d
SHA25697648777c46efcbb625d738b64b5c888ea850e8d94b1ae01ba49acc3bb1a5777
SHA512883d8f694ff8d8b2f731ac2a3eb2385649f0e1cf99069ec63ef068fcb600ca6a14b381dee621f54ed10b859ce4fc22c80f0aac7c6d4f0a766e0481ad73096e8c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD522e19d75b6daa2d191f43670f97c7ffa
SHA1f528b584ca2548191f43b343c38e8d5f012ac10a
SHA2560e0db6441f7d2a2283b02c31354c7a51181330ff6b47d80bd1d8189d1096a438
SHA5129cc155250adeefd4254036f6ab990ba09ccbac0e2cd46ba8e8d66aaecdc1a9d517fc07155923ca9b40fdbfd67ff87fc9159f762a2176923984f500e08fba9013