Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2023, 23:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/
Resource
win10v2004-20230915-en
Behavioral task
behavioral2
Sample
https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral3
Sample
https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/
Resource
android-x64-20230831-en
Behavioral task
behavioral4
Sample
https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/
Resource
android-x64-arm64-20230831-en
General
-
Target
https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 50 ipinfo.io 52 ipinfo.io -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1060 msedge.exe 1060 msedge.exe 3448 msedge.exe 3448 msedge.exe 1488 identity_helper.exe 1488 identity_helper.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3448 wrote to memory of 1412 3448 msedge.exe 84 PID 3448 wrote to memory of 1412 3448 msedge.exe 84 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 3704 3448 msedge.exe 86 PID 3448 wrote to memory of 1060 3448 msedge.exe 85 PID 3448 wrote to memory of 1060 3448 msedge.exe 85 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87 PID 3448 wrote to memory of 4676 3448 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.radicigroup.com/newsletter/hit?email=%7B%7BEmail%7D%7D&nid=41490&url=https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/index.html#[email protected] https://pub-812f0673288845f4bf7f094981a2df19.r2.dev/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc301346f8,0x7ffc30134708,0x7ffc301347182⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17423173401850363329,6800572214165496951,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4564
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD55ce072d1e12fb8aebf9fe8fe241e9c79
SHA12adde99d394bdbe8ecf33e7c1fc4c102df202052
SHA2563d99734454e62a98bdf7ee1e8d53c83dbe323eae7719e03ebc74c4f7a44dc40b
SHA512328c33715e5a2d5a35972f66b587881226434cbf4766a42ae7119996df5f79440c79cf56a4f45cc8175cfb1c8b4f46c82f46f01aa553fe8dd64ffef59ed808f7
-
Filesize
1KB
MD5aa6e4ebb2cadff0d28ee31ca27f20203
SHA1d5dd8d70e88dc474ff3f978fb59a4f1f40826d9e
SHA2562dddebc8161f7b2daa45e7b5e7c55b467c0528f847b198689d2f5f428c7ed94b
SHA5126fb8079e32dc0651456412a8c52eebbd837275529f6156ae86bcd7304bb082c654d86a3c9e171fe3bb8e657d5b89ac1ac1e36ac3af4ceb6f22114eeca85f85d9
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5dca30542e6a9c99f9266c82847cf491a
SHA116fd58d7230416d509e35905dbcb01677bd8d8f5
SHA2569854175ad673c06e89656b2f6b7a9b0fe648511b673a7b96ad482ba8bd8426ad
SHA5124cbbac0e93cfb4805ded8b9575bbd58e8ef79f3c45ac6d24d626108ac6376949a454c38791c0ad7c24f320c63dcf90c66e0f346ffe0e71fa8a543f99ea7c6d63
-
Filesize
5KB
MD54f4715a97722ab74c059f7fb31de6dd6
SHA1e3e48114c51b236cb7f774aadd20d47aaf8a0268
SHA256bd06ad19ebfca1fc2f0398d419705c17cd36b7b5a38edb5a07981c00e7e67813
SHA512153495b8f2ade3c673600b7b76acb46a85ae958b192a81ef8f550ea3af256821595829a7b676e3ab218f63447526f3091923c3b02d886fcc7593dfea4db75fe9
-
Filesize
24KB
MD5699e3636ed7444d9b47772e4446ccfc1
SHA1db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA2569205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e9d8fdf6a904eff7d864a9130d912f1e
SHA1de57a44d977c2ec23452ef8c99973d1d0ba0725c
SHA2560c24c3c6bc7859a26b8fb2e2b0b9fdd4bbd5e0dc6a0dfcb7e2e20e02e4b9da2c
SHA5125d4e7bd638e2d9f4b11680b432b5c822addc081f40b91904a103e270cf86a9adac6e9b268b7def525e58079b3e638fab369081d33530c9977c8bc46ecf624866