Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 05:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://email.ceofreedom.com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA
Resource
win10v2004-20230703-en
General
-
Target
https://email.ceofreedom.com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 1604 msedge.exe 1604 msedge.exe 3620 identity_helper.exe 3620 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1604 wrote to memory of 3624 1604 msedge.exe 55 PID 1604 wrote to memory of 3624 1604 msedge.exe 55 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 2860 1604 msedge.exe 82 PID 1604 wrote to memory of 4440 1604 msedge.exe 84 PID 1604 wrote to memory of 4440 1604 msedge.exe 84 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83 PID 1604 wrote to memory of 4556 1604 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://email.ceofreedom.com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa02546f8,0x7fffa0254708,0x7fffa02547182⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5000 /prefetch:82⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:4596
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2388
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2cc 0x4a81⤵PID:2024
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b950ebe404eda736e529f1b0a975e8db
SHA14d2c020f1aa70e2bcb666a2dd144d1f3588430b8
SHA256bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4
SHA5126ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5bea2dca1e5f961a682c9e77ab4fad9ec
SHA154ee7a399813cb614b5570587ebadd78f73bd33d
SHA2562c963b81304c6d97fa45e2cd6db411247f7302ad344babc21ac53df12303c07d
SHA5126a2e570974fb26ac51889a4fe84a37ac5b1f5757657b47f7ce8a3197e7104e93a63a7d9ea410b7c9d24832e2a608a3b345899aedf69d66c5e27215603d958c9c
-
Filesize
5KB
MD5456a7b8d02ff31a5b10859de8c9c2080
SHA106df0b0e0adcc0fd85614d3be21d9a5257005829
SHA256d76ebb32a3d1d5c732d4de63dcebb6cc33e6b635302e4c36ad5711b73a464af7
SHA51221ca195b84a33d2168e649098e20b0192f04eee77fbf18ebba94b00cc0f28ead4cd075af8bdda7c251cd303e2f5f7df4617ad161b90e2f85c1d7ecd1ccb48679
-
Filesize
24KB
MD5ca36933e6dea7aa507a272121b34fdbb
SHA13b4741ca0308b345de5ecf6c3565b1dbacb0fb86
SHA256fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d
SHA5125a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD582b8ba415b298c5111a0797ef2240cc0
SHA1a3a902794364afab7e71f7b4e712a3503e1883c9
SHA256b502cb735dd86d15a37be1b409a12a617e70713b498b9c2f335c47543e04aaf9
SHA51274799272d3203fea2eaa940855e56702fc67723beeff719acb3dc717e4db4d33045fc8dc19a2be392dc1bc7cf671b9b7ee78efe1e2bb6cd5b2eee377060dd2a3