Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 17:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://thepastorsplaybook.org/ru/
Resource
win10v2004-20230703-en
General
-
Target
https://thepastorsplaybook.org/ru/
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 1224 msedge.exe 1224 msedge.exe 3840 identity_helper.exe 3840 identity_helper.exe 4348 msedge.exe 4348 msedge.exe 4348 msedge.exe 4348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2932 1224 msedge.exe 83 PID 1224 wrote to memory of 2932 1224 msedge.exe 83 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 2220 1224 msedge.exe 85 PID 1224 wrote to memory of 3212 1224 msedge.exe 84 PID 1224 wrote to memory of 3212 1224 msedge.exe 84 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86 PID 1224 wrote to memory of 1728 1224 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://thepastorsplaybook.org/ru/1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc97c46f8,0x7ffcc97c4708,0x7ffcc97c47182⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:82⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:12⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10185378932388012398,7422074717130353213,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD570e2e6954b953053c0c4f3b6e6ad9330
SHA1cb61ba67b3bffa1d833bb85cc9547669ec46f62f
SHA256f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4
SHA512eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5bf86ea20defe979e0dac7f426056bc31
SHA1d0c6cdcce5601bd2a2e1bdda2da4c2e1bc155458
SHA2567a8839f4c5235d595b0bb789f0d2defe0786127fbebd38738bcc77282fde0f84
SHA5128bb91afd7677d7e4f7ef2f99985d04776d798acc726756bad560ebbd3fa5d0cce15c468910879a2d64cac99366da59ae9ff69436361809059205f6777c319767
-
Filesize
5KB
MD5797795326f3487284df66c2df81451b9
SHA17c7b8de340b40f54d50fafbb3b2f45b3a28eed4e
SHA25657811b6c40ddebcf3f310726d12f4be3744d83da5758c496def9a28d204e03ab
SHA5125eeba0a8f38608f2b6c4e431c022782e008b9c8084a0117b8ea1427ff62821c44a71237b72dfe9e9825d817e2f8ec23864c0fddbb62300226eb97ca6925a9b8b
-
Filesize
24KB
MD55a478f1e08816969e8214f982850b754
SHA11cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c
SHA256665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489
SHA5127e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD51dd7ed53ef93a7ccc347416e040cac44
SHA169c9a58401d0617b1f6ec108d276f6e5a14217cb
SHA256b28671b06a731b34d1aae1b7396938e677bc3895c20d1ed063b19fa03cf94740
SHA51231fa314e02b62a6fbfa27da250f0bea3bdad582432241ffe956ad91ef87e709504e393d36ef48877d7fc7533a291c1f35f3424362d149c78e3618a1d1c5f92ba