Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1680s -
max time network
1780s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 13:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://google.com
Resource
win10v2004-20231222-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4752 msedge.exe 4752 msedge.exe 5112 msedge.exe 5112 msedge.exe 1484 identity_helper.exe 1484 identity_helper.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3924 5112 msedge.exe 14 PID 5112 wrote to memory of 3924 5112 msedge.exe 14 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4524 5112 msedge.exe 20 PID 5112 wrote to memory of 4752 5112 msedge.exe 19 PID 5112 wrote to memory of 4752 5112 msedge.exe 19 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21 PID 5112 wrote to memory of 528 5112 msedge.exe 21
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bd846f8,0x7ffe3bd84708,0x7ffe3bd847181⤵PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11629263099463848323,118047102525824719,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD53b690b99a1817f7236841579d6fdb68a
SHA1fffa071cd96339aa2bb53cda79f090a295af22a9
SHA256732b5947201569f6898d468a14d7beca65630548966634a938f74dc3e0c00674
SHA5123457f9e9803894f38cbf9585272788d596158746c8412c54421637272610f1ffdb80f20127b3f1880b508450ffaab534d5920d839881e59238757282d5b4a9ca
-
Filesize
978B
MD50a470751c13915be87a2df47ef49ac51
SHA17446f6576328cb799fb12b48f5f8ea98f29ed6b4
SHA256bab0bd2b50e48e709cfdc64dbb09e6778b40d852192348ba4c166b56ad3d3c1f
SHA5125378ddffad402513fec39ff6930dacea683081f4629a4f060b30551510a42df58eb53cc5b6d6fad6c87df5d8df24e26d60ed37a817b622b1fa6ff5c6c77264bb
-
Filesize
6KB
MD5597042473a1913f81ce5041409bd41a7
SHA1ee20c7270f5c2ac34d66b096c609f116edf1fd37
SHA256c53f9ebf070865e1ff5a03d26fe42a32bdad85ce09688bbebea123b8ffe343cf
SHA512860ec861cd82046f8cb1064a5277638a70f9e239efe9720e5c0b00763552cecb9b67db97cb471ec409e61c86f5feedd484541ac83f1ea3c95cbac363fafe10d9
-
Filesize
5KB
MD59f18d059a199b87737a95a2f1c036dc6
SHA10474051222ffc8af65a244d4b664035ca4368a4f
SHA2567640064b151f31e8b30c181d1818496ffc60501ad10ba7f9f96d47daa6b4e391
SHA5127d8c2c5f21ac07c6a057690b22493274af3164e128bb35ec5519f2bec9dfb77c16a7961d4f1f6fc42c590fd5e670be97479b7c4c198d777ed8f9c19a115f8eb7
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a04098c97f7d233faa6435348d390593
SHA121fa0ee61649a843ff8af55094d0500698e59cb6
SHA256a0dea269a736968e023486ea18e670a2bd9d8ab6b75511fb23e21bdc197b770b
SHA512a1662362a9963d1d7ae96f3714ee709820e1ecb3d13a84782c7219642bb234bfac6c5b8d66ac01cf805e1fa834aabcbdca319cf1124a2ce21fe50c20b2958b10