Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/10/2022, 00:57
221025-ba2vzabbel 919/10/2022, 05:41
221019-gdw2saegg3 119/10/2022, 05:38
221019-gb4c3segf5 119/10/2022, 05:36
221019-ganw1aegf3 119/10/2022, 05:34
221019-f9raqsfdbr 819/10/2022, 05:29
221019-f6qj2aegd4 819/10/2022, 05:28
221019-f6b2msegd3 619/10/2022, 05:26
221019-f45wyafchq 619/10/2022, 05:10
221019-ftnjxafcen 919/10/2022, 04:53
221019-fh358aefg9 8Analysis
-
max time kernel
67s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 05:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://we.tl/t-ZRlwhHea1p
Resource
win10v2004-20220901-en
10 signatures
1800 seconds
General
-
Target
http://we.tl/t-ZRlwhHea1p
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c111f85a-4c34-46be-badd-caafdff20456.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221019053511.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4904 powershell.exe 4904 powershell.exe 3856 msedge.exe 3856 msedge.exe 2984 msedge.exe 2984 msedge.exe 1604 identity_helper.exe 1604 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4904 powershell.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4656 2984 msedge.exe 85 PID 2984 wrote to memory of 4656 2984 msedge.exe 85 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 1620 2984 msedge.exe 88 PID 2984 wrote to memory of 3856 2984 msedge.exe 89 PID 2984 wrote to memory of 3856 2984 msedge.exe 89 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91 PID 2984 wrote to memory of 3344 2984 msedge.exe 91
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://we.tl/t-ZRlwhHea1p1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://we.tl/t-ZRlwhHea1p1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae2246f8,0x7ffdae224708,0x7ffdae2247182⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6276 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:12⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:82⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:2136 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff62ff05460,0x7ff62ff05470,0x7ff62ff054803⤵PID:4652
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17294433136310691540,190635675798568713,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:12⤵PID:5516
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3544