Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 01:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://banrraurls.web.app/
Resource
win10v2004-20230915-en
General
-
Target
https://banrraurls.web.app/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3824 msedge.exe 3824 msedge.exe 876 msedge.exe 876 msedge.exe 4184 identity_helper.exe 4184 identity_helper.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 3440 876 msedge.exe 76 PID 876 wrote to memory of 3440 876 msedge.exe 76 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 4172 876 msedge.exe 85 PID 876 wrote to memory of 3824 876 msedge.exe 86 PID 876 wrote to memory of 3824 876 msedge.exe 86 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87 PID 876 wrote to memory of 4136 876 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://banrraurls.web.app/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe80146f8,0x7fffe8014708,0x7fffe80147182⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17227730406449983810,16625500292492760771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD50b6397eabc40b80737c0744a7d1d38e5
SHA1324c3a822f3098a14610cd94959331329c138cff
SHA2565996264f5705dbe90fd9bdef3f3eb3ae30ff3c1f7a3b70e98b241255301f0423
SHA5127cf6f42dde5ddbac7695e85a4b8f33f1e32df612d35a18185cc56813f594b27ccf1804151c2e5505472b339f61e4f40abfec3b13921d59c08d01dd1969d96ab9
-
Filesize
533B
MD52445f66a46f26dadec312cf4a4fdff65
SHA10040072e9d757741af6f449e2b65097d6fe7144c
SHA25614e53d0a8667dacc2eda53f191f0b6bdfcb5775a184c7f94056af5b901e58fd5
SHA512ad65c3409df301d6205981bd7051f99830250b3547c6f838e2bfe1c627c07e0ef92725237cc68c93ba4682f9521bd2c0f905c0b501749e1ab35c77264a530a5e
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD554e918a26b74e234518068abc3e0f55f
SHA1b64c1647916d530fdb0427ff3744bbc315a181ad
SHA256d713b6ed574db87858f7d6f184b4f3a965ba224f31d64923bd33cef32f02a2c1
SHA5122988eb97c9ad31638400395f359a71fd29ac8c9d3b395ee9d4a12f35171a03705ca0ad549d1d6f61af5b2a08ef58828afb24b82a6f9eb0a96ddc7ec75a31eb7d
-
Filesize
6KB
MD524e7e506d7d84ba90d132e5558845158
SHA1bc946511d90f217d90b11db742f2fd7e048183e0
SHA2564ecf2a571b246b59a32277d3e76416e68f0092f505ac5c3a4bc730b2ba7d9fe9
SHA512d580e3e039eed41921505239f6d4fe84c3da6b947e5ecf9eca08807d8e9f4a58e959554695e9254f88bd38ccd56d47892bc056d04b8b7014c72c469b9c84f8bb
-
Filesize
5KB
MD57111d0d32c3ca031cbe273e13a8432c1
SHA13a80d73ebf336bb37e7125c429f2ef9b331a8cdc
SHA25693f0d941f71259b1187a359a0acb050b34a19dac6ad0adfcd661002d924acd72
SHA512499e9260fe0c152152ddd74e9235fa8cea0ec1c0b9b0a82e35929dd14fe80902e930945876446ab0413fa5fdb7ff8b9280fa69795e575b84cace44ecbbf40415
-
Filesize
24KB
MD5699e3636ed7444d9b47772e4446ccfc1
SHA1db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA2569205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50d97a9545bae8c9f3e552731b30e0fe2
SHA197e48694d74436ec98a2830ebd653748630418a8
SHA2568698dde12360f39ee633972c3e80fec5346aed5fd31648b79a3176a29e4a0487
SHA512e5050baa58f3a1a285695210a998519f03fa7ace88930645b5c8ade87f79383ff9a297b13a9469064ca32d96c3afc8a2b0e2eb84e8cadd53697fd42fc93dcf0e
-
Filesize
10KB
MD5d642844c35d6a33a34b14c1152de70d5
SHA1ee2ae1b61745db790ba78fa26b046f8c5e6fc304
SHA25633fbfddd52c3c47034149a385800df9da4275447c9f72513b36347288b6b486e
SHA5128f457ff3cfb4b6948af3d804550d564663b532092894e67959b7b8846cff4d176a7b460ebe87e1680ce70ef9e7a926996e8d4816f666700b74c2298b87727370