Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/10/2023, 14:47
231030-r5ypssfe77 130/10/2023, 14:45
231030-r42easfe63 130/10/2023, 14:44
231030-r4ewasdf4y 1Analysis
-
max time kernel
65s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2023, 14:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://aimware.pl
Resource
win10v2004-20231023-en
General
-
Target
https://aimware.pl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 216 msedge.exe 216 msedge.exe 2608 identity_helper.exe 2608 identity_helper.exe 4900 msedge.exe 4900 msedge.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe 2152 devldr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2152 devldr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2152 devldr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 2600 216 msedge.exe 30 PID 216 wrote to memory of 2600 216 msedge.exe 30 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 628 216 msedge.exe 90 PID 216 wrote to memory of 3064 216 msedge.exe 89 PID 216 wrote to memory of 3064 216 msedge.exe 89 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91 PID 216 wrote to memory of 3284 216 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aimware.pl1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fcaa46f8,0x7ff8fcaa4708,0x7ff8fcaa47182⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2184,8602234976033686488,17594406554080917075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5096
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:564
-
C:\Users\Admin\Downloads\aw-v5.1.13\devldr.exe"C:\Users\Admin\Downloads\aw-v5.1.13\devldr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58f30b8232b170bdbc7d9c741c82c4a73
SHA19abfca17624e13728bd7fa6547e7e26e0695d411
SHA2560916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be
-
Filesize
178B
MD5ca56252bd33414857ddc872e312d2d74
SHA1d7124ae1c54830d80dc6a9beced9becc3e11350f
SHA2562a03dd8b8f9e680bf48534f4770feca8de38bc3cc658cb330cee6676e4925419
SHA512c0139488b2fe0e91d8127786834cde71a7276137bf66991f40a8e824bc54f4ecb2ae808cdd9896ba5b5fb720340f097cc05d80ad2fa807646177afb0e70e0622
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD581a4a7e77554e5eaaeeb20f6705f0e9f
SHA140222457e1a89e81865e53cc7b17292f976783f6
SHA25643909996130160c1c86165e843a88dd938896a6775272b5501ecff8dc395d01f
SHA512033f219c720a9029992cd2577937e8360eb5c37c9ea18074d9cded58699d012a4428761558a4c01354aed4c2780d1e37cd70970165f29f1031cd12bec6075158
-
Filesize
5KB
MD57749f79f460a59c9287a69b6faf801f1
SHA1025918a7f2771f47d0f63037e0512ce72d436aef
SHA256785378bf62f5a7add22651fcc045a7ba868c5ac9b4d26ac843abae67f02ce654
SHA512c231b68f33b5730b75a53f2a74c8a0264111bb3105e557aacadaea6bc391675f5ca0549238f90113b5d9bcf5dd141cde819c132487d90c8bd144362fbbf3ca06
-
Filesize
24KB
MD5e0b5dd9bb8d1258e5e647648629d3eb0
SHA1d73c8cd7ecabb61487ef20322c0ed96db6c2a8ef
SHA2565324cf21ff466c67bc74eee0e05f6c4ed0a2bc44cfd5426658457d62ec0ebd29
SHA51262cc1a6e0c7b8fb572f825aaa5fa81dc92091c9ed4cb8037663e7101eb092d09ffcb7f1d326f0fede82b7cdb22ce5adf2b9c95fe9b9f9852a7660e9446128240
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD564d4fe5f94c57058c748dbcbcb4c695d
SHA16c1002c58a062d0e3db69f5be2dc070aa29d6db7
SHA256f85041a88b8aef00f351a791d0413dbc3d6d0d360d6b2ade14cc6bc1b9a17794
SHA512ba93ed329ad4939034b42f2b8706383114ec21196c3355ba03b20f9a47b8937c4f36179d705f0523ac661b946c7ebdf6ad3b0bd4f8723b142752a089a441f349
-
Filesize
10KB
MD5444cf24570361741945ef2102a8302d7
SHA1cac822eaa23b52b62225877ba75e12ddb07ed1f0
SHA25622affeb753143838d7e8b568a8f9477e78da702388dd127cccef5e86f35bad96
SHA512efc4d4245913e59a8325e638b540489deae111f283801e67f577cd605ff8b3bbe43fff531a73f77048173949dadaa932e4f15d0b3f2242772a3598a38fe6883e
-
Filesize
3.2MB
MD5dabc264b1369b180503547a10929e254
SHA164e9a7f6bf6a0f9c00a97f622ede0ce84195ebda
SHA256af86006262e394a832aa6d8ee25aa34215fbedda54ccac04da3b5406c772c5cd
SHA512f80e16b632705fa7be49f2a0e91533921d6d21999c9ca870930729e246c061cd9b42265b5342848afd99c276bcfa871fa146624c5c38d490940217e12decc0fd