Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2023, 00:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://instant-myato.info
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
http://instant-myato.info
Resource
android-x64-arm64-20231023-en
General
-
Target
http://instant-myato.info
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2044 msedge.exe 2044 msedge.exe 2524 msedge.exe 2524 msedge.exe 1804 identity_helper.exe 1804 identity_helper.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 404 2524 msedge.exe 83 PID 2524 wrote to memory of 404 2524 msedge.exe 83 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 488 2524 msedge.exe 84 PID 2524 wrote to memory of 2044 2524 msedge.exe 85 PID 2524 wrote to memory of 2044 2524 msedge.exe 85 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86 PID 2524 wrote to memory of 972 2524 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instant-myato.info1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec37146f8,0x7ffec3714708,0x7ffec37147182⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:82⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11289282633922176553,18445632647809007922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5712 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d67e492c4d061397ae36c3a525f9293b
SHA192083310b6dfa6554f01b07aa3aa15d1de8fed7f
SHA2568dc0a24ef4b837aa40c996d03195e0b52dbf715ca6f21147d2cb3a8a6db8177c
SHA51289d0f12253ae45412dfcc1eb6c38547c34791aeb821fb26e38ff7348615c62ef135cc147ae6f6b10c62cf80b87dde410d94b572a12b3a3161e089f1ebc65eae9
-
Filesize
152B
MD56dded92ec95cf9f22410bdeac841a00d
SHA183c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA2561840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5b105ca84a49567db83770f46036ca31f
SHA1380280d312d3d1dac1e01afcc347bf14ce10b843
SHA256701c2796be6668cf87b6ef51fe0d4d5774922b74d527715a7165d7a0eac51d81
SHA5123b2f81edb76ccb0f000b7571976b72e96d7fde6338657795a53cad313a623f3cef2b405e19be6594119851d19799f13adfb820780b2cc2877ca86d4f7fc14f0c
-
Filesize
5KB
MD545cc6f29dd164a7eae1b5cb84a28c628
SHA10a56e6282a07fba8f744fd6ad2407f5285ebe9d9
SHA2569cc58c0dacf9c351f3982ee1330bf9fd2790d9bee5991db3e1717f94af2ae689
SHA512e3ac9fd7c6f5d794f96cf1cc363ffe02912ffb8ead181771ba24a44527649f98a03ce493b0b92dc1ae595dd92f9205623416b5189ae181c58910e9d177f44a6e
-
Filesize
24KB
MD5e05436aebb117e9919978ca32bbcefd9
SHA197b2af055317952ce42308ea69b82301320eb962
SHA256cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
SHA51211328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389