Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2023, 23:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://myauconnectagreeclaims.info/Auclaims/
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
https://myauconnectagreeclaims.info/Auclaims/
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral3
Sample
https://myauconnectagreeclaims.info/Auclaims/
Resource
android-x64-20231023.1-en
Behavioral task
behavioral4
Sample
https://myauconnectagreeclaims.info/Auclaims/
Resource
android-x64-arm64-20231023-en
General
-
Target
https://myauconnectagreeclaims.info/Auclaims/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1056 msedge.exe 1056 msedge.exe 2140 identity_helper.exe 2140 identity_helper.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2204 1056 msedge.exe 83 PID 1056 wrote to memory of 2204 1056 msedge.exe 83 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1140 1056 msedge.exe 85 PID 1056 wrote to memory of 1996 1056 msedge.exe 84 PID 1056 wrote to memory of 1996 1056 msedge.exe 84 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86 PID 1056 wrote to memory of 3820 1056 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://myauconnectagreeclaims.info/Auclaims/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffc84f246f8,0x7ffc84f24708,0x7ffc84f247182⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 /prefetch:82⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3642746924725685502,8227582008727886952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56dded92ec95cf9f22410bdeac841a00d
SHA183c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA2561840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5843cb625885f9e9959cbc0a2dd07b318
SHA1b60ebb5833214703c221cc1d2213a06d7318f400
SHA2564fec8e3c9d481c51f6edbcd622d0019b9c8111341164ac879a53edbddceccb04
SHA5128baa6e261bb860dcf14155319129c2370d978a3cb52c645e499f2a4fa0a81fe34ee75b8a5c092dbd84b7929f5b78b388b7b396d3274f43e59e1ad80116d8a88b
-
Filesize
5KB
MD5dc5b8a9f1411462bf777f00f24395277
SHA1993135d64565ad292b00526e6b5018ec35800886
SHA2564be1c52986fb2df38915e7d50ed03384a67847a07358b3552a76f43816f95716
SHA5129043af6ccf15bbfd7f7f9062c43f30958f8892a9894fe06fae1ad028778887840a706019e265534c480b87c7a39675121f5499e5f206230daeeaf6e79ea21da6
-
Filesize
24KB
MD5e05436aebb117e9919978ca32bbcefd9
SHA197b2af055317952ce42308ea69b82301320eb962
SHA256cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
SHA51211328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD59823ac6d92fcdab8df85fd818926e03e
SHA1d70706f61e9b47aa41b8f118bf1626a7de6aea3d
SHA256ba43c992d10af4d07ba59fc463fdf6e6b33fe52a4d1439edcb1edaf9fc2b6d6d
SHA512d28d0fc52dfbf3f3902140fc0cd75f61f6dd8a37f098bb7d532e214948c4c3cf62e07b8403a332b2e4a5add65263216a5035e67b630d97ab1ff17252f085a24b