Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
260s -
max time network
279s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/10/2024, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas-1.html
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas-2.html
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas-3.html
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas-4.html
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas-5.html
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
OEBPS/Prov9789132163562Pojkenirandigpyjamas.html
Resource
win11-20240802-en
General
-
Target
OEBPS/Prov9789132163562Pojkenirandigpyjamas.html
-
Size
707B
-
MD5
079fbf5c4d5571aca289d9e930e492f4
-
SHA1
c23218e46b291c0dab6103fcd88ddcb450c35c42
-
SHA256
763b545a8d1a7e91af926dc0b997ee59635985486e41fc23d9d638d06f8581b5
-
SHA512
44415f93de37c843eb9cb8ef60ad88ebdf0b56668b31f4dbf2b984a5dd012b11cab71ff690e84740df6cc10961b1acfb9f7e259438b1fb26d6618be6d0f611f4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2152 msedge.exe 2152 msedge.exe 4356 msedge.exe 4356 msedge.exe 4364 msedge.exe 4364 msedge.exe 3696 identity_helper.exe 3696 identity_helper.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 4056 4356 msedge.exe 78 PID 4356 wrote to memory of 4056 4356 msedge.exe 78 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 4068 4356 msedge.exe 79 PID 4356 wrote to memory of 2152 4356 msedge.exe 80 PID 4356 wrote to memory of 2152 4356 msedge.exe 80 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81 PID 4356 wrote to memory of 5108 4356 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\Prov9789132163562Pojkenirandigpyjamas.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe565b3cb8,0x7ffe565b3cc8,0x7ffe565b3cd82⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,11047948709557300630,8642117744484016316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52ee16858e751901224340cabb25e5704
SHA124e0d2d301f282fb8e492e9df0b36603b28477b2
SHA256e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c
SHA512bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba
-
Filesize
152B
MD5ea667b2dedf919487c556b97119cf88a
SHA10ee7b1da90be47cc31406f4dba755fd083a29762
SHA2569e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f
SHA512832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72
-
Filesize
5KB
MD5bd0cf54811a3c2ca684170449fbfb389
SHA152db596fb6f8c4a0876e6b7814542656cae8423c
SHA25686e89f2ffdebc6c7fe7f2a38bbd8da6f9c5edf6bd40c62cd1118ed78f36716e4
SHA5120e705113bee7e5c2b184330fd40d7895303da09847ade45133f9ab18d6261855cdf491cb5e1d7c3f1366292c90b46b18fb3678f54e1df29cac6d829fa2e3c331
-
Filesize
5KB
MD53d4021c2678e61eaf9791ad912d0e9a5
SHA1b8cd6c4fbb0a97a0886aa6e3143102d41b1c3e02
SHA256d9e07684d3e7070ab1c02e2fe2972f37e772e28ae322a6e007feb674e02ed174
SHA512c1d678d723e5a84bbfd176de561ed5088c3755274fddf48add61df8309f8a659a4b8b7d9eeb71617b77f47b16a17539c6b1e39a54205d38688f839bf63eb6215
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5541f5e8ea492df1fadab772c75d86e91
SHA1b7946f2c8c5a01fdc4d663fb160d6839b06d1153
SHA2561c9f986c32fd5bb2a6ca1c640977b13dad3ed8bf206c4be339b159538c4ba955
SHA5122a0e32123b4f49595e624264c3cc71854e08cf6ccaf197f8c9f5ef87ed618cef7cc75f633f4adc67ea14090f3389371038649521971a9af354f5da42d760687d