Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 11:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://axa-kaartlezer.com/crelan/gate/64dc118b29156
Resource
win10v2004-20230703-en
General
-
Target
https://axa-kaartlezer.com/crelan/gate/64dc118b29156
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1276 msedge.exe 1276 msedge.exe 4120 msedge.exe 4120 msedge.exe 3496 identity_helper.exe 3496 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe 4120 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 1640 4120 msedge.exe 83 PID 4120 wrote to memory of 1640 4120 msedge.exe 83 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 3032 4120 msedge.exe 85 PID 4120 wrote to memory of 1276 4120 msedge.exe 84 PID 4120 wrote to memory of 1276 4120 msedge.exe 84 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86 PID 4120 wrote to memory of 2256 4120 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://axa-kaartlezer.com/crelan/gate/64dc118b291561⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98c9a46f8,0x7ff98c9a4708,0x7ff98c9a47182⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:2428
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2588
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3788
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53423d7e71b832850019e032730997f69
SHA1bbc91ba3960fb8f7f2d5a190e6585010675d9061
SHA25653770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649
SHA51203d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d
-
Filesize
175KB
MD52a9c0a1074358185eeb6b70954ebdfe9
SHA1c944e4dc2d1c703937ba0c9ada25927bb3373983
SHA2564dadc11ec68efc62c2ec5fdddca582d3f3bc413b85351b5d3d7285cf8d2f0cd4
SHA51229c9d5895fcbdcb5999a40a5068d378b86c50a2ccda983049dcf5b9a184fb2d1162fa0a7225f1a6ae07b993fa4d251f6aefe5df008c055fe1c2fc859c135b339
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD52e11851711efd377529934dd20bf8839
SHA18bda8fd673556ccd3d6ab25b2dcd30323520c7fd
SHA256d33ad0ff46cbcad2bc03a5cac25a3edf9a889b513d6bbe7360575c95d4354ed0
SHA5122eaa0f687d3ec5a5954e46e6c2bd351cc9fc6b9f7f68fb9b78b3f167d75e8ca179356e613a1157fe7d7e5796c99563706a71908d8004d8faa6ece36c65f75612
-
Filesize
964B
MD55992f95f58fbd5b9fcce55da19219c84
SHA19bbb9b19a65ab9139cd3e9d5e5cfed167ea4eee2
SHA25612df042d9c40b3c86344a5536edca0558856390225588a48a2e64c78803d681b
SHA512ccbce8fd1a8fb5a920fa817c5317d6c03024fcd154b8ab38dc9c1044027bc40ca8e1c4258c2d2469f0af028e7ddf915bf2260db695ca6fff6e0a36fa40c42621
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5c9eaafbfc7987b86783a2c886d1891d3
SHA14fbe5f90b7da76420260c6f1675edf18dc4cf409
SHA256b4fc93ada2450bddd014f21080b847be0ffe409e6cf73739a9a5d22e2de203ed
SHA512879d5e0e94786d09fe792ea8086ca1a3ee0b65dd228c5cce35907a7fa91e0404e66accb9efde566e5465a7f53a817af5556385512fa34595c73e84e5f67fd8fb
-
Filesize
6KB
MD5f0b666328023ebc919fbbc1073ab0b35
SHA15d212fc24aa13c06bfe3c92ad3f595d17689660d
SHA25656a742851499281e79fdbdd7e1908742e7493cc1fc9d4ca5ef08e5968e7a0a04
SHA5125c5430d92b3bef9d05e5d20ca5334356a44e9165405e19445c910bee475fc5fd82050eb965c0889c8952d652c9e03e09eae62d84b843be6f140385c95ba58735
-
Filesize
5KB
MD5a3fb060e41f2096797ac9706064275f2
SHA1b3f450c2f5b66822ce5ac5c0dd75ddd8d7b826da
SHA256eb62db8958ab70f8704e5ee51d3c1ab19f546b59ab189a6dfde98e0cd59cfd43
SHA512b9f43f77bd74f6cccaf5295cdf167ebaaa88340753df6f6668426ec51eac6a9dd99bd33d4f3b48f86be6b3bb83cf51c7a52a5b9bfa1da9c04788c7543a833f6d
-
Filesize
24KB
MD50e78f9a3ece93ae9434c64ea2bff51dc
SHA1a0e4c75fe32417fe2df705987df5817326e1b3b9
SHA2565c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68
SHA5129d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d
-
Filesize
370B
MD51d30523c0fc9f11c124df5ac5ee8a710
SHA1e7f53a56080ccc3e53d17d75721b4d5e13c41f04
SHA25665d5d25fa4ee8e8bc1c35b1e21c563eeceeb8c48c38a16ae3b5971b48a96e12e
SHA512a60212d68acc75869e73269d531d5d02457206e063ab50bbdd947b9283a0459851b7133b99987286ce2160588fa21a399d26f11ac033f4e59510da2d21574d08
-
Filesize
370B
MD5b8757316d8faf78fec77b78581dc1a3d
SHA166d5687f4660818a1d1cb8af48609d00e176fa05
SHA256240e95d8cd0d6853c9ea1a005722130ea008cd1fa28d07dfd66e02b78ccde329
SHA5127bf000286e2cabdf23fe892c36b699b7473ceef4c9a3fedeeb5383e48b4020aac360e033b2f7ae66324d93106806b344f3d3f5589022f7fc9e30b2fdf7e51fd0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD557d51272e73c3237a796325d2f3856c6
SHA15a3b0dac9b42bbc60685162a1b5c97de0d2d2528
SHA2564abb623963d94648a8f6eacadbe8c872815ff1e68ede5d0d42191df1e85e9c1a
SHA512748854d0fa433f57100351769340f528a2ab7329edf8dd82bd0c004d03930db564226f3a5f4aa9f63fc50efe8f7c1684528d19d9041a0ca284a5a3b1fef397f5