Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2023, 03:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.ly/incomeg0vdebt.review
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
https://t.ly/incomeg0vdebt.review
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4264 msedge.exe 4264 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 1904 3832 msedge.exe 22 PID 3832 wrote to memory of 1904 3832 msedge.exe 22 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4780 3832 msedge.exe 88 PID 3832 wrote to memory of 4264 3832 msedge.exe 87 PID 3832 wrote to memory of 4264 3832 msedge.exe 87 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89 PID 3832 wrote to memory of 4816 3832 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/incomeg0vdebt.review1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb885346f8,0x7ffb88534708,0x7ffb885347182⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9910279011966525898,10564679526428782794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:4196
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53d5af55f794f9a10c5943d2f80dde5c5
SHA15252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA25643e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
SHA5122e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
-
Filesize
5KB
MD519d6f82b5494c3a67c54fe9d147cc3e7
SHA1b39a90843f445482565fd7bcefd2d0cad57606b4
SHA256f0d4cf2b7338725dfd9e6868b738803ce211f158d8c720df4574c02e00cdde52
SHA512c9354c9ea302aa1c2bdcab3dfa500f38cb89bad17b8f1d2bee5c14899dda8bc8e4163ac1520582cee04a64eedda7a769b12b6e894421ee39127380c04cfe8fd9