Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2024, 08:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nl.arjo.com/unsubscribe/u/925983/4bb4c02d46e70910936bcbab1d3d8327577c11139e69712b2ee26b56c5d5fa6f/675779350
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://nl.arjo.com/unsubscribe/u/925983/4bb4c02d46e70910936bcbab1d3d8327577c11139e69712b2ee26b56c5d5fa6f/675779350
Resource
win10v2004-20231222-en
General
-
Target
https://nl.arjo.com/unsubscribe/u/925983/4bb4c02d46e70910936bcbab1d3d8327577c11139e69712b2ee26b56c5d5fa6f/675779350
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3416 msedge.exe 3416 msedge.exe 3548 identity_helper.exe 3548 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 1624 3416 msedge.exe 12 PID 3416 wrote to memory of 1624 3416 msedge.exe 12 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 1608 3416 msedge.exe 24 PID 3416 wrote to memory of 3124 3416 msedge.exe 16 PID 3416 wrote to memory of 3124 3416 msedge.exe 16 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15 PID 3416 wrote to memory of 3796 3416 msedge.exe 15
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8703046f8,0x7ff870304708,0x7ff8703047181⤵PID:1624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nl.arjo.com/unsubscribe/u/925983/4bb4c02d46e70910936bcbab1d3d8327577c11139e69712b2ee26b56c5d5fa6f/6757793501⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2162971217509829077,3206410032799839876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:1316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD572642020db1321cfea870605c0d45ae8
SHA1e347a33c6e3b86b8149caaa1f8bf9a4336ab68ef
SHA2564568911c1b3ccc3ecffeca47280b0a1887284b7a10a8575dd3fc5d6165b62803
SHA512ee8758762c17f7d457793c9bd8d814400a448181b8aac5a6e6726a9cb76943772e24dcebb85cb5f61053df03da5a43dfebba5e9cd005e238d522b6789e07bef9
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
1KB
MD5e7c07e866b0575352a194d5765dfbd6e
SHA1fae188f200936b368ed4d32a56937ce2ed7d5b16
SHA2561f598e6a08b4f62b5686cbddf2d2e328abb2acaa46f1fc962c9a32565f5a759e
SHA5123c11f0bd99497d12a58b1da9174d3530a63bc09d32afb5488dceb97951ddb70c3c1395c8b3b6b742b4bd6a952e48bb5e0a6de0ed9a9f24d2ddb2d4b7cb9fabad
-
Filesize
6KB
MD5b20d2af5cccce3155f1b4e1d688719f4
SHA1b3a51c52f8b95547892857cc286ae621c3313875
SHA256cfb188c9cbee42a926601ff0ead41394c5ad30f50c329a5eeb4893348f3721ed
SHA512f3f99f3a6130383a0924abfadd8cfb0aecae7e434aa6a3b99ea5a908418e62dd7a91895929b30223b9ba59b98678cd5fbaff89604303a45b3eb7bd6c0c84921b
-
Filesize
5KB
MD5d09f0b897ad32edcd3ef93c590ba79a9
SHA10d032c440e2f18fdc6f8c26511e09770dc9c4ec6
SHA2563a542f2307cc5ca68db88f11ec5dd87b457f35cac40fdf178a026680a6bbdf63
SHA51208722cf30e965391bbd80fa2c82d852131d77719a9ec7b27e2e8b7def9f6e57535ab23bb440eef88b372134e2458eb9cfbade646bf0b5b085edf583f52ac9306
-
Filesize
7KB
MD5cd98260f31d116faf6c6c397a059d542
SHA1f9ca0da4a87cb41ac1dbac818358fe501239657d
SHA256f0f6c7d0c3de7bb853efd3c1266627c54e81adabc72b2a3a32bbb540b7cf95a0
SHA512e1f479041480a7fb1b14177d1113cb6b46ea30e7c10d9797d35205f715acb10bbb00ce5bd6cb07d4ab7904a43762d034dbadb3cbcab067fdf119904089ef02c2
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD513009a6ad8681264618e4a1098679d9b
SHA174a0e75f1b34b0ed31aee75af058f90ad3cdc7c9
SHA256f11b8110e55a2bd1c700b707266beda3dcf6ac50d9fe8170ea138e7b6fd12072
SHA512f174bf08e7c7eb9ae9f009b55f98e5af01b1cb53ac9c5d10f86faf85f4eda1e63caf6e0d11fc9e8b0ab6abe6f390ac8be37f9525df750d0aee2e06d51c7cd9dc
-
Filesize
11KB
MD5dd2f9041e9faf25b849180c18b20e607
SHA1c5eb9ceaece67473f5e4454c7ccc48bcd1c9c4d9
SHA2569cdc1601b936da0a289699acb69d6c965def2fccad96790acbf4a28145d4c84b
SHA512a8c1dd16ef7fca6e35e007e2588e6a23245603ffd2419869c8b08e81fe60daf6b3869f733906c7395f8d358df606b2438e2fb71337a171a309c0bac661984d22