Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 10:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://xn--danielpea-s6a.com.uy/Cde
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://xn--danielpea-s6a.com.uy/Cde
Resource
win10v2004-20231215-en
General
-
Target
https://xn--danielpea-s6a.com.uy/Cde
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2800 msedge.exe 2800 msedge.exe 1612 msedge.exe 1612 msedge.exe 4556 identity_helper.exe 4556 identity_helper.exe 1976 msedge.exe 1976 msedge.exe 1976 msedge.exe 1976 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe 1612 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4380 1612 msedge.exe 44 PID 1612 wrote to memory of 4380 1612 msedge.exe 44 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2676 1612 msedge.exe 91 PID 1612 wrote to memory of 2800 1612 msedge.exe 90 PID 1612 wrote to memory of 2800 1612 msedge.exe 90 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92 PID 1612 wrote to memory of 4212 1612 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://xn--danielpea-s6a.com.uy/Cde1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bd1346f8,0x7ff8bd134708,0x7ff8bd1347182⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:82⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6994692471124015947,8994993072712828870,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3532 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57a5862a0ca86c0a4e8e0b30261858e1f
SHA1ee490d28e155806d255e0f17be72509be750bf97
SHA25692b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
SHA5120089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD590b4f6d0700dc45672dcb58898a3f1d2
SHA1b676d98dad9cad0b20a95aed2ca0cda96e2807ce
SHA256a5b869627a14064a141b6c31eff491105d3b9d70b6491c894244fd0d3b71ce3c
SHA512c631819034ac0c807a5c7fc046a0624ad77626744812ca856ca5b031c1b142a580087c1ae1bebf4cb4b72ce300b92724ef2ae5eba851d4359e24f6216557a2a5
-
Filesize
5KB
MD5ca2d13f48094bb1b9b866940f8ebef29
SHA1f5c9186917796ae42b0785cbf58f82862e272aee
SHA2569ad168641f83f46bf4de67f7957d822f9085a5dfa697bcb85e6cfa9ab1fadaa8
SHA512fc4a13eaaa99c91ff9f0febcbd0739f31388fe1d90ef80b49d89dad897e3ca8716b800e81fe3e65086ee8527b792d4561dca37ff51791787ad9eebdf6f7708de
-
Filesize
24KB
MD552826cef6409f67b78148b75e442b5ea
SHA1a675db110aae767f5910511751cc3992cddcc393
SHA25698fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
SHA512f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5693494b3b439478bd1e6d83f313877e3
SHA1dfb9d562914d09bded7502a6a4b4666c83738665
SHA256d0f0d09fca2517a0824ade6bab9e50dfe801ea5a161b0f9c323641746a872d01
SHA512e954d4dc6a6eeb70b116e7ae19cc6ab63c6168a418e0ee74c20e1518a7239b9e1b3603de7b50af28b8bf73c4e1aa543276a7e6721080d2999c7f66f4925251fc