Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2023, 20:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.zetaquira-boyaca.gov.co
Resource
win10v2004-20230915-en
General
-
Target
http://www.zetaquira-boyaca.gov.co
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4552 msedge.exe 4552 msedge.exe 876 msedge.exe 876 msedge.exe 4348 identity_helper.exe 4348 identity_helper.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 2220 876 msedge.exe 51 PID 876 wrote to memory of 2220 876 msedge.exe 51 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 748 876 msedge.exe 86 PID 876 wrote to memory of 4552 876 msedge.exe 85 PID 876 wrote to memory of 4552 876 msedge.exe 85 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87 PID 876 wrote to memory of 864 876 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.zetaquira-boyaca.gov.co1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe80146f8,0x7fffe8014708,0x7fffe80147182⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8452936379584025543,10218759757374209857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:812
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:972
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD5f50cae078ef00e1531ff7638b99b398c
SHA18fd3fea6c3def1a5b9f1d53ea5ec8fb34cabedee
SHA256f938b70eb475046e493b1caf9dfbab8ca73176a35fe2407a4a310e165a816c55
SHA512693d4493b2bf14b9527efdb7182d72ad8b9e332d70203421a03e9c0a40d4d5ebd7a3084bff30b404f5b8acf89818753aaa57700af5a570214e8cdd6c64fc276d
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5f9fa09de9314219c59b26b311725ced8
SHA1dc85c7a38150c38e7b10fa05c0ed6f353c0d43d7
SHA2566c2778f1ff92ca18b1f3809f11d2577fb8375ca113dbbd0c98e737fa3c9501b3
SHA512a0f92f80052c938d5678845c9824e4296dc80c437d887c00227f73569164654e40d5d1bd49ce017f1add353c7bad8f695d660642519e653db08feecaa184664a
-
Filesize
5KB
MD53ca7069d1429cfaeb8089a38a7ba9008
SHA1dc82c2514ff26d90b205423218b920c63a7cca12
SHA25645b8a9991d029555cafe00ca7ac9ddb03f6c9d4e798d4f36c997baa54b5b96dd
SHA512e2a32264fa73e11ec8e8c16b403effd0540e624bb9bb4db9b066a2870bcb492819e8a4b6f218db236572aeeb47362e37169b4a1ccc9f8cc71ae8cc6f03c5aec1
-
Filesize
6KB
MD586d6c0e4f7514cadc2815b26144ee7dc
SHA1560a96c86e77f24ac7cf42311632a3e18f0178da
SHA256260e51c1d8d4166e97f0a48b31d098d6826662e3d86a1a83bf6168a09641de2d
SHA512766adb07ff92fe4b4874ed84d05e0b78de86064ceaa73a6cbf1e9ab3b3cd979fdaa1f33f5197d9f37461476182644293debf5b3d220928b077e450002bcd0238
-
Filesize
24KB
MD5699e3636ed7444d9b47772e4446ccfc1
SHA1db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA2569205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5847f5e7b524cc9aba07bd9446f6f76ec
SHA12446790aacaa79a8f717773f09b6ba7239cfe20d
SHA2569ac2f6cfa18cd250d757f2318408945ce61b0cc1ff011cff6a4d4d72bf321ff1
SHA512f0a099aac10b0853a0dc4df9d57844b2266cbc8afa642337c72271ac1ce89de2a8dfd361fdd2b8dd68f41fd7b7cca0dea831e6e6c8791774f0cd927f222740f4