Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2023, 13:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://link.gy/9ce71
Resource
win10v2004-20231025-en
General
-
Target
https://link.gy/9ce71
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3204 msedge.exe 3204 msedge.exe 4508 msedge.exe 4508 msedge.exe 4460 identity_helper.exe 4460 identity_helper.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe 1516 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1740 4508 msedge.exe 86 PID 4508 wrote to memory of 1740 4508 msedge.exe 86 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 4688 4508 msedge.exe 87 PID 4508 wrote to memory of 3204 4508 msedge.exe 88 PID 4508 wrote to memory of 3204 4508 msedge.exe 88 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89 PID 4508 wrote to memory of 4260 4508 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link.gy/9ce711⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8371546f8,0x7ff837154708,0x7ff8371547182⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:82⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:12⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,391326026499920308,2993278273587379568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d44956887c169b2a9e8b29053c542068
SHA1d6bdd576de903b2f6e46d16676a3d4cbdd9b904e
SHA25671e4252024d1c421eb5b8733b5c79c0f08ef222e2d04025983b47c5b4a2b3e9f
SHA5129ed720401ab3ffa47197a5bff699aed9693e4c96b1e1aba198f328d00d89276a46291f2a65ccc6d8510057540ea3295923e38790f3c1552acd536616ca64e370
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD5e21374fcedd9247a33c035b284ccf5cf
SHA1d59c5abebdf3244caaf5e19b92a0907012c9735c
SHA256fbb41c1f57dab9cb5865fbae867fe84593ab4393eb9bbdd2d67b215f731c1803
SHA512f448f9fb610050ec16dbb8fe231288095e7d85496ffaa15ffa98577a1da7b204c9bd820039a13793ee8bbc50ae48a50551aaeda0791d1fab47e04b570228278f
-
Filesize
1KB
MD5362832533abe4495e778c2461b394d38
SHA10da8fa8f7b5adc0674c7567f1bcc10940f9630f0
SHA25673d8b33872fa95d71bcac0ce1256ac19d7cbfaf2dc00878274459da85819112b
SHA512766686f58a0cb270dd8731c257015de1b35f2c71a93b273c6b327381a1c8924e762d7044306b9b172bc4a13fbac6119620a1c5a926cdac1b31eff97b68c5dbed
-
Filesize
1KB
MD5b33450ccb7cba268fcc5c970539bf29f
SHA1f0700d517e59113cf38d68846b6aa850050357d2
SHA2561c14a62907ea1ef75c58b3701005f9f7fbdfb582112a88f8056b84850b8cfb2f
SHA512ed351083768bddd151011d2030980daf35fd130bad2979e965169e71cee9e782d22c0cd4d26fa9db6863f9675549393526a3a86ed37622c1fef4fb3c8fc2010b
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5c7e6dcb8b533088a8bb6912613d2d78c
SHA159bdd1a976dde7127a021415e2f98104fec8e87e
SHA2569d852fe5a7b989557812c6f12422316cb8b7f3546b38b152edfab9a868c499c9
SHA512d3a016e1f612dda128baee20b838ea3e354a185ca4df15804dc6e2d413375ca72f040170dad9d51a593d5cbb5a7f1ff5b2abf2183aa3bb4953067c73406a2eca
-
Filesize
5KB
MD54657e8adf467a7970e21d4a00b58fbe8
SHA1fa5a1bbd67e513dc626d31b259e8f84c3ba91493
SHA25600159c076f5513ba82125a0df337102982c49e592eb4a23a376c95f1fb1a8a0f
SHA512c32ec0b5b693c85f85b9365fee4a1a27d4fc0a37ebc937aa2f4beeecbb2ab10cde2389f89ceba01d63da3620648933fe2e56b74e4b74fe22e57a8619ac628a63
-
Filesize
24KB
MD5e2565e589c9c038c551766400aefc665
SHA177893bb0d295c2737e31a3f539572367c946ab27
SHA256172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80
SHA5125a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389