Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2023, 22:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://saratov-gov.info
Resource
win10v2004-20231020-en
General
-
Target
http://saratov-gov.info
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3592 msedge.exe 3592 msedge.exe 492 msedge.exe 492 msedge.exe 3124 identity_helper.exe 3124 identity_helper.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe 492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 492 wrote to memory of 732 492 msedge.exe 83 PID 492 wrote to memory of 732 492 msedge.exe 83 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 316 492 msedge.exe 85 PID 492 wrote to memory of 3592 492 msedge.exe 84 PID 492 wrote to memory of 3592 492 msedge.exe 84 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86 PID 492 wrote to memory of 4864 492 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://saratov-gov.info1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7d0346f8,0x7ffe7d034708,0x7ffe7d0347182⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3457420604484835362,12879638783751698920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50629525c94f6548880f5f3a67846755e
SHA140ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa
-
Filesize
67KB
MD5533ee92f1c59f37538b1e3cc1b93ec18
SHA15814d6c4105e58662acb25f379e474d831bf3094
SHA2560d7aaef92baf3dcdb3bf4bd29ca7ddf70e7c08f24f8f1b7b5ba4b35d779a3285
SHA512edaf220b33176efaa7eccc6c323b5ff74677f3ec84a28c185b31cb8a94b961090fdfcdfd8c3f5a9f10a066a013ac98f903eef7513026f792657485dc1f152038
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD5814e960f658da13f70f92c510a2078f9
SHA1a60b29d31cabf9c205e79ca6fe66acc0f0c8bb76
SHA256ac30d8475730342e5e38bfcb2f552ce1f8171bdc535b304d8f74ea54c9bf52b4
SHA512054befcc23ee8af79645a8b91bb7d26e79e408aae145eed3ca92b0bb4ec8c13120cf0e0656946199540df9ca3827dc9d9b7bf67661f71e59b0130fd69012c61b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
376B
MD52a49dce4ac3dc34d0083f15b332da85a
SHA197e133f1408899f4acc24ad5df182260574459f9
SHA256fa99e73142615333f8b036dcf73498d16eff2a6c650212abccffdc94971baa1f
SHA512ddb32a99d9b1d813dab453d1cb602a3bf738b57a52438dee11cc61fe4b3d6b4c949c5ba4d1d8383df67690955ff387cc606b03340480848463be44de1326050e
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD56c51b939fa109fb61988acd865c8f273
SHA17036471c07f935034b5f6c10cfc1d64b8b24f16d
SHA2563b4f2476d7dff45e6be8f1b0467730d7ba2c2e50a830011972c591c0d5b8b0ff
SHA512d56faa17d3ba6bdefde0abbcc88f42c189eb7fb2e372c8b254d9068bcdca70b934214ef44c408237a68a7744288cddb0acf10d745bfdbf12daefc6ce14662306
-
Filesize
5KB
MD5013f100fe288be2e98dc80c32a9bb10d
SHA1dbb26c3035130fd492eff22a2a9dfe6838dc8573
SHA2560383169a5654749b14939ebd6c34991a7273fc7175e387d3a80433846d598b35
SHA51295afc17ffe4199d20f7425a56b8be128594e191018ffc4a88a4a628a2bb0f0b1f2d5af53545f03a94f918894d9f75ae5805dccb943a9bbeb40f66e36f41ad878
-
Filesize
24KB
MD5fd20981c7184673929dfcab50885629b
SHA114c2437aad662b119689008273844bac535f946c
SHA25628b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22
SHA512b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75
-
Filesize
372B
MD58e1d4591522f171b36f851b495555c0a
SHA1eed906fa34471d46fc10df52e6ebefd29ad8c5de
SHA256f755e57d74d55b32d41fb8db7b0696e39e599d6e120e8427100a1ccb27d990ee
SHA512b83417767cd4e8edaa04c1c8020a88b2d519de577c1c98f962ed32cf3e3666abd01250c6393ec2bca6be8108ae112b41115c900c4de0757e75be9e4bb9356f07
-
Filesize
372B
MD5a205669d079d1a681abe9a2a9726e916
SHA157b9aba7cf411a70ded69185feecaaa81de63cde
SHA25675ee47e8043ea5cae255276ab0583d68a806608d007401621b58dab63b86e423
SHA512d96c3ab96f638fa1cd6e84b92dc2d911861f9d138bcd83b5643cb6b7e2f43c161a2815f8a3b7c790c9e78d2e757e5d3e3b879bdf97dcd305bfa3a65f308da98f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55fbe0518030c062aac21f8d56544b3b0
SHA15eb272070307da5d7dc7ad686fb1b82021747244
SHA2565055eb923ea3dad5e06b360161bc297db82c70c63f7c3070af5449e93f2588a7
SHA512fc27fd0339363765a97f19b5503f516dca3ad6a6ad2ebbbe656da0fdd8d252feef4679235a5f2868a924c6ce5946406ae12ec82765e561a5c417d4475806ef1e