Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 20:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://chriseric1.github.io/
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://chriseric1.github.io/
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
https://chriseric1.github.io/
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 4232 4256 msedge.exe 14 PID 4256 wrote to memory of 4232 4256 msedge.exe 14 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 5088 4256 msedge.exe 26 PID 4256 wrote to memory of 3456 4256 msedge.exe 25 PID 4256 wrote to memory of 3456 4256 msedge.exe 25 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18 PID 4256 wrote to memory of 2292 4256 msedge.exe 18
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d4946f8,0x7ff83d494708,0x7ff83d4947181⤵PID:4232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chriseric1.github.io/1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3432 /prefetch:82⤵PID:5504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:5496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6677587487418641824,14773710493726341301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5900 /prefetch:22⤵PID:4896
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3556
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2920