Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10some-sampl...1.html
windows7-x64
3some-sampl...1.html
windows10-2004-x64
3some-sampl...0ff.js
windows7-x64
3some-sampl...0ff.js
windows10-2004-x64
3some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...04ed7b
ubuntu-24.04-amd64
6some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...60.exe
windows7-x64
some-sampl...60.exe
windows10-2004-x64
some-sampl...5f4.js
windows7-x64
3some-sampl...5f4.js
windows10-2004-x64
3some-sampl...5fc.js
windows7-x64
3some-sampl...5fc.js
windows10-2004-x64
3some-sampl...6fd.js
windows7-x64
3some-sampl...6fd.js
windows10-2004-x64
3some-sampl...ed5.js
windows7-x64
3some-sampl...ed5.js
windows10-2004-x64
3some-sampl...9.html
windows7-x64
3some-sampl...9.html
windows10-2004-x64
3some-sampl...bb5.js
windows7-x64
3some-sampl...bb5.js
windows10-2004-x64
3some-sampl...4.html
windows7-x64
3some-sampl...4.html
windows10-2004-x64
3some-sampl...e.html
windows7-x64
3some-sampl...e.html
windows10-2004-x64
3some-sampl...a4f.js
windows7-x64
3some-sampl...a4f.js
windows10-2004-x64
3some-sampl...0f6.js
windows7-x64
3some-sampl...0f6.js
windows10-2004-x64
3some-sampl...7.html
windows7-x64
3Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2025, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
some-samples-master/010c1e2ffb9d2fc30a429b7db204ed7b
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
Behavioral task
behavioral8
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral9
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral15
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral21
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral27
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
some-samples-master/027159c684c78666d4a1eac52f89cd57.html
Resource
win7-20241023-en
windows7-x64
General
-
Target
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
-
Size
143KB
-
MD5
00d2876c4ad4ef3bfefe452f55da9432
-
SHA1
44f948995f0f1484e6722a6813a5637a98fc4b04
-
SHA256
1854f945faf9c07d8df37e7083ca9704ba84a7d6de3cca87d710b0ded208528c
-
SHA512
635c37149356f4b9dc27865e26264fdb5280cd3b33e9c2257859cec189ff9232e1d19454de430cd84e286b5704e74117f8ee5ef2928693af8557a6beec70bb92
-
SSDEEP
1536:YwhO+/yubrJhy6aBL8d4D/W0FDujXYvlA+FasPl/4pseLdA1UW+cw:7/yubrS6aR8QfFDmXYLaCJ4pseLSUbcw
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3132 msedge.exe 3132 msedge.exe 1984 msedge.exe 1984 msedge.exe 4104 msedge.exe 4104 msedge.exe 4104 msedge.exe 4104 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1376 1984 msedge.exe 85 PID 1984 wrote to memory of 1376 1984 msedge.exe 85 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 2204 1984 msedge.exe 86 PID 1984 wrote to memory of 3132 1984 msedge.exe 87 PID 1984 wrote to memory of 3132 1984 msedge.exe 87 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88 PID 1984 wrote to memory of 2888 1984 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\payload.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacfbf46f8,0x7ffacfbf4708,0x7ffacfbf47182⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2424 /prefetch:82⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3316654146122681743,14839376548691795823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2732
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56cdd2d2aae57f38e1f6033a490d08b79
SHA1a54cb1af38c825e74602b18fb1280371c8865871
SHA25656e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff
SHA5126cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a
-
Filesize
152B
MD5f2b08db3d95297f259f5aabbc4c36579
SHA1f5160d14e7046d541aee0c51c310b671e199f634
SHA256a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869
SHA5123256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75
-
Filesize
6KB
MD5e89315a060b0b7629183b24cc8c65469
SHA19c4cff5395c242d5a2145ac3b94cf89857a9b1a2
SHA25665fbac8656beca11ac50a426ac231d2332e6834e47082596188b73693ae1d6c8
SHA5123648f5a049fd697b91b4848091f27fa86b62c5aa283d42493e002af45318dcf3ccbfd43e82ac73948c035e6444fb723e74f696bb9784770c11ff1aa9a57ea58b
-
Filesize
6KB
MD5d47cc9a1d7e67dd76ab22b2168f86830
SHA1866db38995031105db016e7c81b1b5ba193a2ba0
SHA2567aa287beb3e7e554ee10106894555f6591967917e8452dbde5bd1e669695741d
SHA5122d0c4ef465d06343b3bf7b1979763ced0e45e79fdeff9d181b08a1cf2a8ae8f1c8ad0ed0b96337a0580b3ec30a904033b2f5608904dcc7d387e17dc05a4bb3f7
-
Filesize
10KB
MD58175ca7aa5919a45f9cc1dce17602d48
SHA1bddd494aed700fc844a71d1c79b4783e0376844e
SHA256a84992133024e55955922fdcd8d62fcdcff37a9db72e30cf06de792362fc0f9e
SHA512841b89f0846821ae58eb9090bbc2dec7c6d73c84ab7e81b4b842eead944ba4830bfa3e258682c2934cf651b0caeb8172532110d532b67ba5a630634fa0a9f5a0