Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3index.html
windows7-x64
3index.html
windows10-2004-x64
3login.js
windows7-x64
3login.js
windows10-2004-x64
3vendor~login.js
windows7-x64
3vendor~login.js
windows10-2004-x64
31487.js
windows7-x64
31487.js
windows10-2004-x64
31555.js
windows7-x64
31555.js
windows10-2004-x64
3191.js
windows7-x64
3191.js
windows10-2004-x64
32054.js
windows7-x64
32054.js
windows10-2004-x64
3209.js
windows7-x64
3209.js
windows10-2004-x64
322.js
windows7-x64
322.js
windows10-2004-x64
32284.js
windows7-x64
32284.js
windows10-2004-x64
32632.js
windows7-x64
32632.js
windows10-2004-x64
32962.js
windows7-x64
32962.js
windows10-2004-x64
33156.js
windows7-x64
33156.js
windows10-2004-x64
33190.js
windows7-x64
33190.js
windows10-2004-x64
3320.js
windows7-x64
3320.js
windows10-2004-x64
33638.js
windows7-x64
33638.js
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
index.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
index.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
login.js
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
login.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
vendor~login.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
vendor~login.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
1487.js
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
1487.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
1555.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1555.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
191.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
191.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2054.js
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
2054.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
209.js
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
209.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
22.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
22.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
2284.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
2284.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
2632.js
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
2632.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
2962.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2962.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
3156.js
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
3156.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
3190.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3190.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
320.js
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
320.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
3638.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
3638.js
Resource
win10v2004-20241007-en
General
-
Target
index.html
-
Size
1KB
-
MD5
09e4aaf583dfd32bd7b8b2b6f33bd0cf
-
SHA1
7c0010727c56287444da78ebe88903005097c109
-
SHA256
a364800c9dc423b9fdda0c7b6e29ffa37b60f011f41ceecd7dce4b4fd30bf706
-
SHA512
e432e6724d9eedba1301941ca983309d174fe938af4edbc36599a0c0f171f0d2a94648fd57e291d239895ac01e58ef3fe6ee00915a057035d05ac57dbcf33ee4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 4464 identity_helper.exe 4464 identity_helper.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 5108 3040 msedge.exe 84 PID 3040 wrote to memory of 5108 3040 msedge.exe 84 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 1188 3040 msedge.exe 86 PID 3040 wrote to memory of 5112 3040 msedge.exe 87 PID 3040 wrote to memory of 5112 3040 msedge.exe 87 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88 PID 3040 wrote to memory of 3960 3040 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba9dc46f8,0x7ffba9dc4708,0x7ffba9dc47182⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:82⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12833740674447902349,12059893330786735719,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3156
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fab8d8d865e33fe195732aa7dcb91c30
SHA12637e832f38acc70af3e511f5eba80fbd7461f2c
SHA2561b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA51239a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
-
Filesize
152B
MD536988ca14952e1848e81a959880ea217
SHA1a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
-
Filesize
6KB
MD5a06d722ce7a7b4730be1b7f0a9a7b71f
SHA1b89492e7f7856c009aab8fb4cfc671c9e3f95ed2
SHA256a11cf72cea8f4560c72286df15806c3d9ca2559f427aeccf47cf02a70ae8442f
SHA51220dbed2c7c128f0191a40e0f6a0c5dde7d00a3a4d3e1da6eb3ef700d7a6fb8a0de41ae7b9abfbb51101b37595923678dac90baf03a03a8ea33771d1f8845ab02
-
Filesize
6KB
MD5418c43cbc7b8cb40e0fbef7640c74108
SHA1c30af036b39e88a30a15f343639a9ea6082557eb
SHA2562d4d927ebd4e2fe1a06db9e135daddf703549796039c8fb1a2ed5a19aba78e2a
SHA512a1a44811a0271c41aaa0a1e852bf2b4a6ca2d5702c31af53ea8496b7990d25a93d6b18b3e6ef57da43200f419b2bc3af4fa403c77835a53eb39bc3ea274e822b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5fb13d682b627e3e5b8ee699321c4d7b5
SHA111d1a7f283ad7c51a928e8834f0a0141e45c5b55
SHA2564984bdb19ab85b65d5566aa6c2123fcfcf8541d2edf82c771316d3f79342d9cc
SHA5128c2818522c9b9db85f2c231ebb3c3d038fc71e82b2c5cca27d6ff83683c16ec83ccb65e30e3180a67c54e37ea5bd7d0e9cf0f36e01c3a93e51cb1aa7b9d97583