Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 13:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://lorented.com/gf4/101123080
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
https://lorented.com/gf4/101123080
Resource
win10v2004-20231127-en
General
-
Target
https://lorented.com/gf4/101123080
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4788 msedge.exe 4788 msedge.exe 2040 msedge.exe 2040 msedge.exe 2232 identity_helper.exe 2232 identity_helper.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2920 2040 msedge.exe 39 PID 2040 wrote to memory of 2920 2040 msedge.exe 39 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 2228 2040 msedge.exe 90 PID 2040 wrote to memory of 4788 2040 msedge.exe 89 PID 2040 wrote to memory of 4788 2040 msedge.exe 89 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91 PID 2040 wrote to memory of 3984 2040 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lorented.com/gf4/1011230801⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9a2946f8,0x7ffb9a294708,0x7ffb9a2947182⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:12⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3588 /prefetch:82⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5032
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ef2ab50a3d368243b8203ac219278a5d
SHA12d154d63c4371354ff607656a4d94bc3734658a9
SHA2562e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf
SHA5124533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5a350f373e956daf61c0880cee34c1bab
SHA150f5920b04155305e9a9b52a88f96442953e8b76
SHA256db399497bc0c66d57917bd0388456828990b55343fae69918e112e853651c93a
SHA512bdb78f1fe7428225b70ad7b2c4450041f9f38bd5e80d90542dc4cbce44bb3b538fdfc57100128a3eadb49abf772791f318a044988f3e7c5e12694c0d8c2e2077
-
Filesize
5KB
MD58fe5c0700dbc7a67a5d0931a6bfea9c5
SHA156a80c7e59464ba5b55c42741841c059c28cf6e4
SHA2563f1b344be0eaf1343066a546aec7e5410270c353f9fac451d078427cbad5b2a9
SHA512a481beeae137fa5f2ac3807dd43f0460f9deef293ac1029a903e9f546f22fa0f4612862a16f7d77943ffb002a90f0d98f0cc3e18d1b4af7a907bf5bb0959f703
-
Filesize
5KB
MD572f586748ff132f04aa6860ba0018af8
SHA1ffba25e961bd0c2b4b4de189291a46f7f9023472
SHA25677c0c0b40e0aafb753e3089d27710aa1be1702add46f79e83f77b50801093e98
SHA512a9ac46b235dce9d6d4560e9e92c4fccf95e77025514920247b0bc6eda453e1c27e380a094694157d7848a0d1cb90f84066e174d2ab1a1d6e4e7dfcd3b26b17a7
-
Filesize
24KB
MD5bf38e67347aea6d520cda5fde321a1e5
SHA10e7a8def4c923201d76b41dfa9918bb1052827ea
SHA2560f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025
SHA512f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5df57a594bbce02a530bc94af8e7d48d4
SHA188ae9bb3f4676537f2480b2b2c13c1dbf766a150
SHA256074af2bfcb80f26eaaa922f10847f50b3d0dc581500a6ad0424304b4a4ba1448
SHA512c1eff3a3294a739dc8f3e7ba381c5375d1d78ce8ced12ab7a8f4993a8d22c90d56006803f64a1e4365ea5bbd63fcd3f4b2f68f453b785b3ba8c6a5b9ba7a70ce