Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 22:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tibco.compliancedesktop.com/login
Resource
win10v2004-20230703-en
General
-
Target
https://tibco.compliancedesktop.com/login
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2344 msedge.exe 2344 msedge.exe 3832 msedge.exe 3832 msedge.exe 4800 identity_helper.exe 4800 identity_helper.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 392 3832 msedge.exe 63 PID 3832 wrote to memory of 392 3832 msedge.exe 63 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 4956 3832 msedge.exe 87 PID 3832 wrote to memory of 2344 3832 msedge.exe 88 PID 3832 wrote to memory of 2344 3832 msedge.exe 88 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89 PID 3832 wrote to memory of 4168 3832 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tibco.compliancedesktop.com/login1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc034b46f8,0x7ffc034b4708,0x7ffc034b47182⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:82⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:60
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3026830030219760818,14832775570428145819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b5f5369274e3bfbc449588bbb57bd383
SHA158bb46d57bd70c1c0bcbad619353cbe185f34c3b
SHA2564190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464
SHA51204a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD58e57cd3767375151d93f0e8f8e35b8ff
SHA1a1b8259db49e76068a98d0075d73d3bd0c3a9200
SHA2568d55efef46e081a12ab7377aaab0d4d401958edefe5e11795198c521455e140c
SHA51243631115016972e3c227fe33ad20ae35b47a2dcfe37324767bcb66d31b8c67f49af818e73e35f63342f8f70baf5d00faa1faa3d889d971f3d13d9c39c3360ec5
-
Filesize
774B
MD50215a3efd0b501186c7200cc0d45d5d9
SHA111a402582ed23df0eda577e74c172ab57429d67d
SHA256a91d87e48a517b60b445457ea0a9482a10cfa199c2b42b651567cd1c8d0c3b79
SHA5121d77c75df6a8d3f264cd6db205e1400e75cddafa6ced2e9ce39b017cad355f4dc9624a088b5747e2d8c010d679436e5e20ee55d749499c20e527a163f5fa2d61
-
Filesize
6KB
MD53c00cda0a603fd82a9465cc41c87b302
SHA120f23088320a265cb1063ac2b1e1664e89be453a
SHA256ee1a5fc1652a868a02f454b0c83abdf4fd3a5333a3b423ef6efaf06acea1a14c
SHA512b20f1245b9c9363a334988ea2587fefeab1ee4c722babdece50140a9e429a6ec02594f6e091f48c7ae7ebf176f3d66013ef3379458b659345f170bd507b5bc9f
-
Filesize
5KB
MD53c569a80b1334a1b15c9d108a62268f3
SHA127fdffcf2402e6a25cbbddb430bd3620503b47c9
SHA2566a99809ab7031e0ece775c36fdd383d182bfd73990ac61b3da4d8d35872c84b3
SHA512bbb11978129aefde5d3262d9b4cd442f8a1a468709799c91c2ed93f899aaefcb67d778827042d018244b230077192dc9806c41eca0dbce54800650ff9f39ee93
-
Filesize
24KB
MD529213338df67d29d6454ee5d61ad3970
SHA18c69ca76a2e639060d5ce835a9600e6ea3764a83
SHA256d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51
SHA51214db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdd56f12-a814-4b30-99d6-ddda41b0e1cd.tmp
Filesize111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
12KB
MD5e919ff15bae011d205a64ea06cc13025
SHA138b2afbb1e4d45edd4c58d6c63731a39454223ae
SHA256f9f124d5bfc4d5669b71c13457643518e07f101b7192619ff2c0970f4b6a4eab
SHA512beec0e2541bc6b09347b8f53153b47ada5546d4d239de791da32dbb419258ec536b5b29456b39c715a1ac6a26b80aea55f361fd8fe9ff6c5fc3cb20c05c91a6d