Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 23:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://45.128.232.187/bins/jew.mpsl
Resource
win10v2004-20230703-en
General
-
Target
http://45.128.232.187/bins/jew.mpsl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1164 msedge.exe 1164 msedge.exe 928 msedge.exe 928 msedge.exe 3728 identity_helper.exe 3728 identity_helper.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe 928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 1536 928 msedge.exe 85 PID 928 wrote to memory of 1536 928 msedge.exe 85 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 4288 928 msedge.exe 87 PID 928 wrote to memory of 1164 928 msedge.exe 86 PID 928 wrote to memory of 1164 928 msedge.exe 86 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88 PID 928 wrote to memory of 4700 928 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://45.128.232.187/bins/jew.mpsl1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe223246f8,0x7ffe22324708,0x7ffe223247182⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:82⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13818777824928915770,10412711258789041097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58411007bafe7b1182af1ad3a1809b4f8
SHA14a78ee0762aadd53accae8bb211b8b18dc602070
SHA2561f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3
SHA512909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5f42d8291921d99b542191a6ffc475a95
SHA1a2616c4915a88309f8907896648d6979037a4fad
SHA2565c5ca548b6715b2a34c0af5c92b4d0e41b2e36cdb42fc634d7950cd14a40d2ab
SHA512718ec2a362cf5b96fceb377037bc90b7c60a9ae11956653ebc6a9447ce6445d5bfe6e4a56813f5f47197bcd48a0dcaa73557bc08b81c53e5f1e9c4c868442f6d
-
Filesize
5KB
MD5413e104bfdaa14c991e3540d91c22476
SHA1b9bab03d5f320179208c04903b8dd00ef67398cf
SHA2565d35baec01061a61b50bde7401fb07d57f1aa90162820f8dc5625b0be142c83f
SHA512839c8150e51526feb8a5e180971b1db4360a636a573071937da9d98a28230a72ee71e03647f1f341865eb1946a10c7b336df7435cb11ee2630b3cd00770f3487
-
Filesize
24KB
MD58caf4d73cc5a7d5e3fb3f9f1a9d4a0cc
SHA183f8586805286b716c70ddd14a2b7ec6a4d9d0fe
SHA2560e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c
SHA512084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD52bd885c14f6be7f91fb87260bdf1dcaf
SHA1a82dcd76c4abfcf80d16353a14678b5ac34d2e44
SHA25605e6f9f9467a9bcbf9b748bfee6ec97e25c923e74bb38a96e535598d52181d8f
SHA512a43e5a9c145053e7237268672a2fb376040cd7c7f6f32202204d95bb0d0be6043f839bd46db8aed8bef35b0e4f90498aed9a703fc53ccaa04e244fb1df14e817
-
Filesize
12KB
MD52f77aefa01ae5737a2f84690a10c35c9
SHA1af0ecf58fd1b756a44f6fcdbbb6bb1cdba73d45f
SHA256bda3c1b0ce625bde605054701e2abf93e0b539a71517c91da0ca6c32af446402
SHA512efd6ccb29b0d7d3bf164b7b9f90faa6c1c539a28477ece163a89a1d53983863b809c3e45e781f2d459e8d6ea4c268755d1e43d9f30cd0a326228820b45d185b6