Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 17:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://chromtech.com/80398-701-asn-10ul-syr-23s1712
Resource
win10v2004-20231025-en
General
-
Target
https://chromtech.com/80398-701-asn-10ul-syr-23s1712
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1984 msedge.exe 1984 msedge.exe 1200 msedge.exe 1200 msedge.exe 1620 identity_helper.exe 1620 identity_helper.exe 5852 msedge.exe 5852 msedge.exe 5852 msedge.exe 5852 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3712 1200 msedge.exe 58 PID 1200 wrote to memory of 3712 1200 msedge.exe 58 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1756 1200 msedge.exe 88 PID 1200 wrote to memory of 1984 1200 msedge.exe 87 PID 1200 wrote to memory of 1984 1200 msedge.exe 87 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89 PID 1200 wrote to memory of 4616 1200 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chromtech.com/80398-701-asn-10ul-syr-23s17121⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0fa246f8,0x7ffc0fa24708,0x7ffc0fa247182⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:82⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:82⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:12⤵PID:5284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17399853068911266952,3274786771807035564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6084 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4288
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x49c1⤵PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1008B
MD5273d689e54b1efe334aef89921de3874
SHA19d2f501ab80697c946d4e815e9a34d50dbb00c52
SHA2563e576a33f3f07f1c16ef4e2f813f1ba3ab240ba52c02d049ec746d104dd6fb2e
SHA5123f44cee6a7528a25f75fda13c3dd01d6bc9882d5975ca9d1175400f36f2b7f1168c3583efda5f5790c238f2b35b051abc0f76d787d43e2a21aeef2e92dc7b355
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD59da426f1c731fe72f4b875a429213d4f
SHA1961de8d39f1b51215c26c56554d81dea7782e7b4
SHA2560c86946d4b1c4a577e4c430a9e2a1fa6cd26d802cdd9e151992eac20e9d3138d
SHA51205cfaa787475779169acfffe51a12236a12b775e371bcea86874f8eba4bcaedfbc6591ecf30b4b113015f2993a9c41913a4b1f20fc12a7efce5e83ae2049f05d
-
Filesize
5KB
MD5951002bfafca1ad8a78799aee7b83adb
SHA16d07816df0dfbcada521e2c10242fd73ba0523ed
SHA2560a12a170c2526efdf4121cc446f2883088962be73f5e132ee8882f47f076db56
SHA51201691a480910cd4e36a26c4735b6383804939d6c5909a0419ee731b1800e78bffc436f58b30dcc28a9c206eb01ae08b43de60f6f648fdf2252bf29e0b41584a2
-
Filesize
6KB
MD50730b81f5e628c985f11d0db9edf2225
SHA1a519a5e85a90ff3f2f75a1bf12c0bd22bbe17d4b
SHA256614cc9fd98fc775ee7b1ac6ab0d5d5ba35c9d7367aa9f3af6195c022add98fd9
SHA5121a56d7105c63f9bb0f4ffbb9606b7d72a73bd88589526ea0c633b49e6a7594389fe6c62f461da463a60a8046a93fece0c4f007f3a76e81c7d07d3d631f192d11
-
Filesize
24KB
MD5e2565e589c9c038c551766400aefc665
SHA177893bb0d295c2737e31a3f539572367c946ab27
SHA256172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80
SHA5125a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b98c649cf1c320676943648575be1c81
SHA19b29da59dbaa3e017718fa704324b9a2ad0709f9
SHA2569ee56474ade8fc2a8bd8d4b1ef66948042b38d567c3d33af37b9d6e668fe29d0
SHA5125258d498962f3c487252980e91f7041ed5d4ac1dca81a78ae67c96ad8ccc96bc0da3b32821aecf15bc2a2e6d1c66af949323af36a26ec6f9ab1c9f0fc4ec298e