Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 09:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://anthe-vsf.com
Resource
win10v2004-20230220-en
General
-
Target
http://anthe-vsf.com
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8e16fe95-3fb3-4856-80aa-551f1cab8ada.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230510112738.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4368 powershell.exe 4368 powershell.exe 228 msedge.exe 228 msedge.exe 2212 msedge.exe 2212 msedge.exe 3940 identity_helper.exe 3940 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2212 msedge.exe 2212 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4368 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3380 2212 msedge.exe 85 PID 2212 wrote to memory of 3380 2212 msedge.exe 85 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 220 2212 msedge.exe 86 PID 2212 wrote to memory of 228 2212 msedge.exe 87 PID 2212 wrote to memory of 228 2212 msedge.exe 87 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88 PID 2212 wrote to memory of 732 2212 msedge.exe 88
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://anthe-vsf.com1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://anthe-vsf.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xb0,0x104,0x7ffdf86e46f8,0x7ffdf86e4708,0x7ffdf86e47182⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1624 /prefetch:82⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:4356 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff727b85460,0x7ff727b85470,0x7ff727b854803⤵PID:1984
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11321264751057274423,3492890099802485956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1624 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3496
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5aaeb1f5e097ab38083674077b84b8ed6
SHA17d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2
SHA2561654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef
SHA512130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda
-
Filesize
264KB
MD51663ee1068e7e47c308515c2a4ce7ec6
SHA19e80b44de6eb13de893e983e10c06e6b66c3d731
SHA25668d0994088f0357205da5c29e160c296c8828e5bc039f8c11fd032eab07ec413
SHA512eee1e6cc531cf20251147ca46ce5354be0d419640d7e86f86f1bbcee95f363ffa1226089531ac586769da7bd34c8b7da080fec12fc2e4dc860b3e84f015d47b1
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD5838da4582d2f7c41e8ed8f510d7e1e3e
SHA1f044b66d52079ea81603a58e4932e604e29f33b3
SHA2561c8913ce3a348c750032ca163080931ade49897bd2c6af3ec176087cd3b0aa3f
SHA512ede788bac515830debec20dfa80716ab473ed59c7350a9b252f4c2e4e1e2e81ee5bc88483f90aa598f7e92e006927281f4f5587fda3e680de8824f7484bf3f4b
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD54e6461a9d67573b69cf915d8db157e9f
SHA162d082cec2d42dec549d4d8b53eca2ddfedbd375
SHA256d5a9ab9972f49cb5ac1d72567a7a67e33d5d70b41231dcb85c1839635a6bd6f9
SHA512c538308fb634121cb624f0dd4dc8993a7b71f1a83c5ccafd6379cf837619fbc8822baef88d14e47d0d64f5ec6b9af01a652635272716d2f0eb6b453f13f406bc
-
Filesize
6KB
MD591331fff45352753efcea7385a93ab49
SHA1a2f3d38bb7862ed495fecdb09bfcb5bdb8012793
SHA256bd6585790d2589cb8c516e8cb8fcb02d61f64eaf27af97f57ff0dd62ed34bb58
SHA5123e548806b5727197365c1bc81ec8ac0d9a2f2efe5c2fbe4bb90746fcd2c19f6d550481c8d238a3ab29f5c9be65c16cf57ab85a016f79cd4026434e40b44cdd2b
-
Filesize
24KB
MD547e94a96372e6f095b8a3fd7edc48ec0
SHA1377b68f34e5964ca8be1b1b0c1507dd7f0e5f005
SHA25615c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e
SHA5125bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad
-
Filesize
24KB
MD59f0074fde03e4044b487d6e7074a831c
SHA10c6245cd015a6803ee32cb6f7796b7fc3a5712a0
SHA25626e93f435b81ede0d1d67fe45b24e35447011b3f911f6784e7062dba54376ec3
SHA5126d758fa72be7c15ab96b84b59c57b2b2573ad167e12a587cdd378972c6ba54265383c77735ae8a14fe018387c7d1a0bcb2dd29965126780be8a2d40f14c3a1e0
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
9KB
MD55e88081d9fe4833c9d3e92156f67eea4
SHA12a2454ed2917f5096c894bdc270e2548b9142506
SHA2568a403b4c54940a82b1d27c0b7eac1c35ab36f2f5f600cd27cf7f11bfc5dd436f
SHA5124f5ddb2e51409affe9fdb6775d265e44e35007bde0929db3f2fa4cbe5013bdd576db856a48e3419294025ab5a48e190bec358e42affaa9aa873d42bf71838f99
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5467d00bd81b8dd34cd977bfbd8d15df8
SHA17c541964fad2488659d470775a7eaf47a2db5c87
SHA256ed1a85ab46a2012c802e22b67a4e04c2dfd72166f367a7717324b4835174ab7b
SHA5123faabf5721592e3bfd5a649c3d6ccb4ac4597ff8d8796f42a876545e46ae25f2b641a97d69486803614e12986cc6d37f492a8cd564eea890bfd72da12ddca784