Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 16:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://m.facebook.com/209687782184897
Resource
win10v2004-20231127-en
General
-
Target
https://m.facebook.com/209687782184897
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 1692 msedge.exe 1692 msedge.exe 3260 identity_helper.exe 3260 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3824 1692 msedge.exe 88 PID 1692 wrote to memory of 3824 1692 msedge.exe 88 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 4820 1692 msedge.exe 90 PID 1692 wrote to memory of 2696 1692 msedge.exe 89 PID 1692 wrote to memory of 2696 1692 msedge.exe 89 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91 PID 1692 wrote to memory of 776 1692 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://m.facebook.com/2096877821848971⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffdbdb346f8,0x7ffdbdb34708,0x7ffdbdb347182⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:1864
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:772
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5208a234643c411e1b919e904ee20115e
SHA1400b6e6860953f981bfe4716c345b797ed5b2b5b
SHA256af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458
SHA5122779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize672B
MD55c5aa2e4554bfed1be1b8a4cfa7f900e
SHA167c58d62312912aaed15cc5b8778a2e532d9b98b
SHA256b447d2ab1662eab9b620b03080ce2ba218ce675f14737fb5d71031d08642b61f
SHA512da2ffa3b005370cbb2f1adc72843d282bb51c9f12dc50c73cc55de0b2729123a165cfbc297bc78ba0c8d70d61ecb84d9473b4ace1d0664028be2ac45ae150214
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
400B
MD5a1f1bf86f595d43611b0bac6f73f8613
SHA1cf9beac8467d3068617a1163bacc3b322c2b8d18
SHA256459c5ca37048ba6846ea9570b3457f1849a3918079ff1158fc4451994cc5ac41
SHA512956853d46779ebf230328b9a6d443189a810051382d6701218cb7edece9dd1f2b0f2c1602aeb34f040f5cbd57a0f7f74384227792f31316575a40fe6dc1289eb
-
Filesize
5KB
MD536cca14e07d15bcf3dcde44c451bd6a9
SHA199df5161b4b87950c288e89bca104347d93e2faa
SHA2568d2f07b3a3d6721fd43786b7eb8c4e9d02a5a5217ae50f1d573bffc8aee313b9
SHA512e8aa36790e31364b4f02896d44ff755dd142179cf3ba1ceecaba28e30c3afe228a128a66085a2cee62ba42ec9f96d78260e798f9eb589be1e846dcf3961ce701
-
Filesize
5KB
MD581464223bba937f1fc452a1b394f06c5
SHA1288dc1cd93bc6695583b996d8ee0da1dac253771
SHA256c6f06ff963e905945b877d9aab970bb0a1b7cc08c869ca5d4630a5070bde5e01
SHA51294ae9b560ac28067f5663466fc2ed5edb6e8949f236df358f24f547242153dfb0c6b402e32e5e7d002f6f808730fdb36d35611f4a788fafe9cef92631ec23e79
-
Filesize
24KB
MD55a6206a3489650bf4a9c3ce44a428126
SHA13137a909ef8b098687ec536c57caa1bacc77224b
SHA2560a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28
SHA512980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78
-
Filesize
872B
MD5d5db4645d3fece1df235f6b9be685e6e
SHA12983eea6f9658fad7ccdf5539695805b7ce4164d
SHA256a0eb713d5adbfbdb81e5a656439c5d1615968ad9eacf191bdb3c4320b891326c
SHA5120a0e2bcecc5ea1b3903c278f9941c3f8699c42968a67d69d861308d8aaaa320f8a0ab5c838637aa50ac1d452e8e02fcac9a9565730885b68081f121884967d2f
-
Filesize
872B
MD5c3dfbf779b7b4e42914ac02f21012c50
SHA120e20bf5f558dfed6164ab6c1e5e3e8c402b0316
SHA256fae5a98a565ac5c0b23bc302b02473dbde9186c75d39a60462b5177751ccd1e5
SHA512ef14f9998bebdcdaf206a0836f709a487cc28c6016cac24b45083771e0e239aadd6f67d65b7ed961694f188a343ee2cb280a25a497eeb67b7479ec9ed5ec4927
-
Filesize
872B
MD5d93649cba768e79401e07a335671df04
SHA18f9c4a53e0bbc4461cd7e5f980a5422092ac8aca
SHA256e0ef2b5b5facd56a06a25f38376053deb6de85955278a63474d32fe17747f43c
SHA512e192e3793449b236813e0b1fa86fea30bf81f27cbe2dc73e78fb94e133bac656ad0ec2b057bec1413014d07d024ec995b37755f2d72fbecd51537fb4157f1fcf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba4cd4ca-3686-438c-a8a2-bc1d0f7285a6.tmp
Filesize872B
MD5d0a19b20ec6bdffef461309dcd65cd49
SHA1ff8bc8e94be60c07a4920fb271f9620865706ee7
SHA2560e3ab678d59c51463ea86ff3434fe5b8899ce21f1af2efd8f04fddf73d7a58f5
SHA5129d4718d2f4e2d759416d448c4bc6a7aabb46d578c5cc70c6623b6f5b54971fbdeff960dac3aea8c05bbf71225caa5c6f05910ae3cc66a8fb72988ec0f21a3100
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5cf4a99e4f14b88d4c856fb8617bf0375
SHA11ace15a2535b93a7b38de28e140f6bf66d4113a8
SHA256a82a1c5a6a36db24f669e454e0cb73a7cfe9f9eaf19dc6a5695fd0cfbb9dc1be
SHA51275fc2c7d379fadc8ae14a91ae016d7f68d5fafccef720310b46683a1d8f6fd57445ba3fb8cd2b8533c97c7deb123c786dc8cc8ae1b4e9bf9a77370ed17527c4d