Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 10:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://enterprisecarclubnews.co.uk/_act/link.php
Resource
win10v2004-20231020-en
General
-
Target
http://enterprisecarclubnews.co.uk/_act/link.php
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 1792 msedge.exe 1792 msedge.exe 3420 identity_helper.exe 3420 identity_helper.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe 656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 5448 svchost.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 400 1792 msedge.exe 54 PID 1792 wrote to memory of 400 1792 msedge.exe 54 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 496 1792 msedge.exe 89 PID 1792 wrote to memory of 4448 1792 msedge.exe 87 PID 1792 wrote to memory of 4448 1792 msedge.exe 87 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88 PID 1792 wrote to memory of 4716 1792 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://enterprisecarclubnews.co.uk/_act/link.php1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0c7346f8,0x7ffb0c734708,0x7ffb0c7347182⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1725193446394333262,10925968903435272224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:848
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3024
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5cbbd48fd3ff90b51a00e8901a7a3b802
SHA10a3359f9c28862ef11fa86766cce4d27ecb76de7
SHA256d2c3ffbfa38f0d537bce05746f34b74d9b604cb8b2306e6ebe456f701a6b466c
SHA512be67be464817bcc2e1d40c443a7ca2448721c223ee44665d5697684eadd0bd51f389b72d59950c4db43f525a91d71a3ba3ab286c8409ba07b8890d20eb62ef0d
-
Filesize
152B
MD5483924abaaa7ce1345acd8547cfe77f4
SHA14190d880b95d9506385087d6c2f5434f0e9f63e8
SHA2569a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684
SHA512e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5053d584abc1348f8bc47f41917b5e5fa
SHA10f37046758c6c56e70224194d44d64cf96586ac0
SHA2565637722ce4e4e6737b25c4adefd593823ba266538daa060e9ff205ee19608f96
SHA5128b53f89b8010d1726c434428b03579ff439a055f233ac2c3268a379ede6a43da5720a1968735745b34dec03c899c1ec914b8d8a5e877c48c22897ab61da4df3d
-
Filesize
5KB
MD5d19548170df8a01b34fd5a404c48f641
SHA19782d834259023dea2b82571228967dc65b06e17
SHA2569251122c02cf23e32b430e3c3f96496fd420c8a63d6552e182c84cb32c7f36a2
SHA51229fe95c2fe5bc4a5f86be411841201478d7e2e1c9257f78bed632c98efd505bd4257400d5bccaa56cd7ebc46837f842c0a93bd7413ac04b33b1fd3955d640096
-
Filesize
5KB
MD5164d9580dae9a35551f2ee75dcb7fb07
SHA12938a874cba814451c3014388941ee29f44adf20
SHA256d927f2256bc6a85ec2da5d600503b755970d12a04cbbc9f8da0b2813e3b64c30
SHA512481be435db306f68366bac77529d4e24da04c7e6aa0a954548c3466adde09841958c5d530a0f09c13bedcfe82ca3d07bec1ce2116406b5635a7ee19e96b2b2d4
-
Filesize
5KB
MD512ee9e95841ae721313bd1b2f1b85740
SHA1bcb137e0d55269411c996292a6b99f12d3fd2bf8
SHA256387a90217c919e808fd61ef41ce56badd6170d3d2fc7323d4be4ee36a0b88119
SHA512c19034d6ebd128bb728d0c382609a5a3258d5c7c27fe0ed8a6cc86c27804617212c1f667632a66a0c28bc88c6c16b980504d3591958b2ef98d8af9ad731a3fe1
-
Filesize
24KB
MD51c706d53e85fb5321a8396d197051531
SHA10d92aa8524fb1d47e7ee5d614e58a398c06141a4
SHA25680c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932
SHA512d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f22f02d904574221dde733930dd6a850
SHA1a494d3b6831805ff23defdf1c5102f7649e258f2
SHA25628c847bb4542460050dff8de98012330989e0fad2fc0b16a3ec5401b35480131
SHA512349cd948a629fedc0357337bb929009a14a89e89b5aa4deedb07374435cbd5c20bd807b612fe892fa9df05ffa1c8767c791c9edec7078542fbf4a9799731e04a
-
Filesize
10KB
MD56d290ffd1bbf05e3f20ef1057b27164c
SHA14e05daf0584c69086c8930b381ec600fb529e389
SHA256a51386c18b32581d80262463c3c0f15482a95fcc211e81a1bc69cc517dcfe613
SHA5123f3f9728d573d7f74f6a7afa2360d81409b188e2b83c0149d153e914ff28616ecf3e0d7be9ffe042447ed4b0589156700fb2b8381df03362a4d05eb1fa184039