Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 00:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://urlscan.io/api/v1/result/a5779103-d55e-4571-9aee-dd5213f96bbf/
Resource
win10v2004-20231020-en
General
-
Target
https://urlscan.io/api/v1/result/a5779103-d55e-4571-9aee-dd5213f96bbf/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2692 msedge.exe 2692 msedge.exe 1656 msedge.exe 1656 msedge.exe 1892 identity_helper.exe 1892 identity_helper.exe 4732 msedge.exe 4732 msedge.exe 4732 msedge.exe 4732 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 4260 1656 msedge.exe 87 PID 1656 wrote to memory of 4260 1656 msedge.exe 87 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 1992 1656 msedge.exe 90 PID 1656 wrote to memory of 2692 1656 msedge.exe 89 PID 1656 wrote to memory of 2692 1656 msedge.exe 89 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91 PID 1656 wrote to memory of 3672 1656 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://urlscan.io/api/v1/result/a5779103-d55e-4571-9aee-dd5213f96bbf/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb73f346f8,0x7ffb73f34708,0x7ffb73f347182⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,16215696547930933479,2871065330538260022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
178B
MD5df8a385ea98ae9d253cbd7bc24c5f4af
SHA1d15acac7c2a5f4c532baa7ccecec9d1dffec2465
SHA256a293e1b3c6d1a4344e5bbc58692dddb3af2540948e866db88c2177482c88452b
SHA5127b2a7021d6326532a91070eba4715e31b51e3e7fd88c2160011d82055c64255f1e33bfaf585320ed54199475e81534112afc51034ca8634ff7ed45004abd5c84
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5680c2b8f10d51e227cfef6d4a2839620
SHA1cfa84c1c7ffb2e236f4a47947690e85d49286805
SHA256fed925b7de6f7daadb1138406901ffb4e051e83ab8fa9c68fecc796709dcc51a
SHA51217d55e254c54ecf3bb87b7ecce5d48072150e0328ed310f366cf8c9b4f21d4601273b92acf9504a3e9f5a5f5dff0218935ab65da853553b2e0b4ffb65ad2b532
-
Filesize
5KB
MD5994d5e94f4a9d81cc490b4615390fda0
SHA1550a717c62189b976ed96a1844f49afd73a58607
SHA256b1f697c3de53bc8f29320e9b07eac228ec4d21c905609128378551ba776067ac
SHA51241b490a7f3c1287e2bbd70cd25d032d4c9e796170f3aa10798806024e25558a3c2148ed5ba5db1b6a4ca46fff56455616cf4b12da67fc1c2d5f7dfb640aa5ad4
-
Filesize
24KB
MD5fd20981c7184673929dfcab50885629b
SHA114c2437aad662b119689008273844bac535f946c
SHA25628b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22
SHA512b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD53e1b512a716a032982e08c15b5ab3779
SHA10623ec67ffb13814ab1428601ec80a119aa03939
SHA256ff42809b31e4c08077399c0f92ca7e49857757979008935767aacf808cb06165
SHA512774c6005bcde4d9ea3a5fc2420265d1d2b066205e5a666ff6ee74377c20f344d6bdf38a2069ba1425761ab6cfb4f77bf692d8c9ca50edd1c156e98c298d9e6d2