Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10some-sampl...1.html
windows7-x64
3some-sampl...1.html
windows10-2004-x64
3some-sampl...0ff.js
windows7-x64
3some-sampl...0ff.js
windows10-2004-x64
3some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...04ed7b
ubuntu-24.04-amd64
6some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...60.exe
windows7-x64
some-sampl...60.exe
windows10-2004-x64
some-sampl...5f4.js
windows7-x64
3some-sampl...5f4.js
windows10-2004-x64
3some-sampl...5fc.js
windows7-x64
3some-sampl...5fc.js
windows10-2004-x64
3some-sampl...6fd.js
windows7-x64
3some-sampl...6fd.js
windows10-2004-x64
3some-sampl...ed5.js
windows7-x64
3some-sampl...ed5.js
windows10-2004-x64
3some-sampl...9.html
windows7-x64
3some-sampl...9.html
windows10-2004-x64
3some-sampl...bb5.js
windows7-x64
3some-sampl...bb5.js
windows10-2004-x64
3some-sampl...4.html
windows7-x64
3some-sampl...4.html
windows10-2004-x64
3some-sampl...e.html
windows7-x64
3some-sampl...e.html
windows10-2004-x64
3some-sampl...a4f.js
windows7-x64
3some-sampl...a4f.js
windows10-2004-x64
3some-sampl...0f6.js
windows7-x64
3some-sampl...0f6.js
windows10-2004-x64
3some-sampl...7.html
windows7-x64
3Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2025, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
some-samples-master/010c1e2ffb9d2fc30a429b7db204ed7b
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
Behavioral task
behavioral8
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral9
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral15
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral21
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral27
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
some-samples-master/027159c684c78666d4a1eac52f89cd57.html
Resource
win7-20241023-en
windows7-x64
General
-
Target
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
-
Size
3KB
-
MD5
0138333b333805fa0baf93f6d0ccf342
-
SHA1
a77bf28547fc0f7da297353b88239c416a8be4c0
-
SHA256
7b4e065405ee4c2a4823ed3fed74da74fb72bb7067fbc3a8f763b9f375efba4c
-
SHA512
b3de560b49414189c5f0a674eaf07e51857d1dc73b0b3d4fe70827edbcfc92d70252b105d9b438c24f751102b6fd0fe898dbcaee1e4664d27440368c9a1205fe
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4384 msedge.exe 4384 msedge.exe 2108 msedge.exe 2108 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1912 2108 msedge.exe 83 PID 2108 wrote to memory of 1912 2108 msedge.exe 83 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 1712 2108 msedge.exe 85 PID 2108 wrote to memory of 4384 2108 msedge.exe 86 PID 2108 wrote to memory of 4384 2108 msedge.exe 86 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87 PID 2108 wrote to memory of 856 2108 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\payload.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb319d46f8,0x7ffb319d4708,0x7ffb319d47182⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13254378676933092552,9348713258077309141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f5da507c2059b715761792e7106405f0
SHA1a277fd608467c5a666cf4a4a3e16823b93c6777f
SHA2568c1d99de087ac5f2e7b2afce66eff36a646bef46800c0c1d7737d6f0df74b7e8
SHA51201c92729dd8061aa122b116a674c73bb78016f66d2cb8f7fb64907352758a825e87a1e345334386440699d2a6d1e17baccb400c5aee151eb64e64019cbebb870
-
Filesize
152B
MD53c6e13dc1762aa873320bed152204f3c
SHA138df427d38ca5ce6ce203490a9fb8461c7444e12
SHA2565c441148843b7c8dbff4c4a72962a532aaf0bdd484d07a03dd9a32fd461b1371
SHA512133054cb042e11013bfdad1bd11e3407d08cf26a66d0743bea9708d261aa904a1047bb0097b187ecf8436cb6cff3bec28c89e435862cad0e0fa264799556b70c
-
Filesize
6KB
MD54cb8cd13be9e86dcf42738436b77d790
SHA15b3faa45f89c1d516b26a3c818ddb6e7cec77740
SHA256b780fd7c33db8c21c7ba4a355a0bcc5c1d2a2687f44c66c2b3fc7325f7d2f54a
SHA512b99ca414f69ba573d2add7cbf8a80f351c0fc72d7f43c2c46f1384384cbb38c6be0982be0f6d9868570376be5925ae79a652ae20738bf777878b35e31cc0625f
-
Filesize
6KB
MD5468fc4e70551d2b29ff81ab7fb881140
SHA1cc943b61429cb21d283fdf113e9adf33cb560609
SHA2569bac785ca961c2f798072236291e5a82009b16af143956bba183ed7a25daa9ec
SHA51239eb4460da4a10b3dcddfa52ace736d8d7ac70ac39023a0c788d74dfd0c1df43ca8a2bd36c1a0ce84a40b03139601e4fa918f9321449d5be2433555695106f91
-
Filesize
10KB
MD506a11e1dfffc13f1eea091b2f9c3e46c
SHA1ff06a3e0ffb40b33bee378a7f3fdb91f7d421dad
SHA25697b50dea6080a1558c694f517ab2818b35cf138afdd31f4a10a7e5dd60f5df5f
SHA5128d922c1ca8445bf506d7779d4472e09005abdac4e2ea434aa29d6f56458dabf940fa3d6fb561e56c256d5eee06c1d98a41c12e2ed196d629457a4ea4056d7688