Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 09:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://concsoweb-prd.cisco.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://concsoweb-prd.cisco.com
Resource
win10v2004-20231222-en
General
-
Target
http://concsoweb-prd.cisco.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3752 msedge.exe 3752 msedge.exe 4192 msedge.exe 4192 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4192 msedge.exe 4192 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe 4192 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 4616 4192 msedge.exe 16 PID 4192 wrote to memory of 4616 4192 msedge.exe 16 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 2036 4192 msedge.exe 29 PID 4192 wrote to memory of 3752 4192 msedge.exe 19 PID 4192 wrote to memory of 3752 4192 msedge.exe 19 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27 PID 4192 wrote to memory of 2204 4192 msedge.exe 27
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff834df46f8,0x7ff834df4708,0x7ff834df47181⤵PID:4616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://concsoweb-prd.cisco.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16223031615225158403,16736926708395533619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3600 /prefetch:22⤵PID:2912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e71d66ce903fcba6050e4b99b624fa7
SHA1139d274762405b422eab698da8cc85f405922de5
SHA25653b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA51217e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
-
Filesize
5KB
MD54a4ae59d8031e975826ce7775d4cbfc3
SHA1b5f9abfcfab1d7b65208a00d0abacf329209fb5c
SHA25682f43413cd328b78805e520bd3a267e5ac14511380e4aff7c9b84ce2bbb9988f
SHA512d7a68dc40155ef393a8a3dc73b20fb80affa907d7eb12935a06dfb6e80baaf5af2da4a9b6649169cf628286b0913cbacaef0d121b6e0d8ae68b2fe17fa028c30