Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3About/About.pdf
windows7-x64
3About/About.pdf
windows10-2004-x64
3About/eulaLic.html
windows7-x64
3About/eulaLic.html
windows10-2004-x64
3PEiD-0.95-...le.bat
windows7-x64
1PEiD-0.95-...le.bat
windows10-2004-x64
1PEiD-0.95-...in.vbs
windows7-x64
1PEiD-0.95-...in.vbs
windows10-2004-x64
1Loader.exe
windows7-x64
10Loader.exe
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 10:34
Behavioral task
behavioral1
Sample
About/About.pdf
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
About/About.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
About/eulaLic.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
About/eulaLic.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
PEiD-0.95-20081103_ExeinfoPE/pluginsdk/MASM/compile.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PEiD-0.95-20081103_ExeinfoPE/pluginsdk/MASM/compile.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
PEiD-0.95-20081103_ExeinfoPE/pluginsdk/PowerBASIC/PEiD_Plugin.vbs
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
PEiD-0.95-20081103_ExeinfoPE/pluginsdk/PowerBASIC/PEiD_Plugin.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Loader.exe
Resource
win7-20241010-en
General
-
Target
About/eulaLic.html
-
Size
8KB
-
MD5
a729d63514511766fcdd2de19cdbd017
-
SHA1
737827e5c0ab0adc287d3b3bb16d26a9a42f0939
-
SHA256
6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728
-
SHA512
ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2
-
SSDEEP
192:HLFjO9B8eBfDX/Ek8IFyMlgy/RVr1YGrtsk2whjPYwWkpeFWlMddhTdLVxFl/:HLFjO9B8eBfDXoIFyLw1YGZsk2whjPYL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 4932 msedge.exe 4932 msedge.exe 2884 identity_helper.exe 2884 identity_helper.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 3592 4932 msedge.exe 82 PID 4932 wrote to memory of 3592 4932 msedge.exe 82 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2800 4932 msedge.exe 83 PID 4932 wrote to memory of 2888 4932 msedge.exe 84 PID 4932 wrote to memory of 2888 4932 msedge.exe 84 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85 PID 4932 wrote to memory of 2952 4932 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\About\eulaLic.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff0e946f8,0x7ffff0e94708,0x7ffff0e947182⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:82⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1372,14693392985961077762,8710326661963345544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3888
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
5KB
MD5c003e1b18b9d5176d23d2238f0b046d9
SHA14dad9fde8c7b8cddbaba0dd57ee0b654ed20503b
SHA25633dd8c675b52fbdd9d4bda84e9cf0c2f3b07e59e163c8ed91501051d3628316c
SHA512e089b973ae490e31189fcbf4038a77bf8f675edd68805eccbb49eff5b0b036379543f02fda44f8429c7df6c78f04e26996d2af3097b503d5da5235b07b87faf2
-
Filesize
6KB
MD58c42dfbbd04021069859f8f4d3eb1076
SHA16429543d63092edfacb1d3f580a6a40c1f83d9fa
SHA256fd016d83320b67f3d771cc3fb251f42d3cc45993b483530345e98f07923fa1fa
SHA51223d2e0f6c55d78a9711928d396261315215afa6069f3f50020894cd82d89d87adc31dcf1d641d2d9a23c9a5eafe63842424c5313864d06525f9b5382140d7b20
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c095310264086dbde97cc4fd7f9e7eaa
SHA13fc387a42f625435192179fd939bc3ecd6aedf25
SHA2569c3d3e36f2ae511d1ee9d2bafbd5893cb12b057072eb8def77069e62d94deacb
SHA512f86a113dd66262aea33103311ba9b32cae5a7dc70a6e28c125bb2820a011c4db9efc2227bfc2cf525a153506cc4959469d69aa7f051d90fa4548b8671e95feff