Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
10s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/01/2024, 21:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sli.thepoliticalinsider.com/click?s=802056&li=
Resource
win11-20231215-en
General
-
Target
https://sli.thepoliticalinsider.com/click?s=802056&li=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 408 msedge.exe 408 msedge.exe 3228 msedge.exe 3228 msedge.exe 4752 identity_helper.exe 4752 identity_helper.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4228 3228 msedge.exe 76 PID 3228 wrote to memory of 4228 3228 msedge.exe 76 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 2144 3228 msedge.exe 78 PID 3228 wrote to memory of 408 3228 msedge.exe 77 PID 3228 wrote to memory of 408 3228 msedge.exe 77 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79 PID 3228 wrote to memory of 4556 3228 msedge.exe 79
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sli.thepoliticalinsider.com/click?s=802056&li=1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd77733cb8,0x7ffd77733cc8,0x7ffd77733cd82⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:82⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,7511062663884861640,2119968160137188567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:924
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d943a8cf4efd126466512b0952309e2a
SHA16a2398d0f51bd03726846cf3e63cf057c9089fb4
SHA256193acec13684c624ad94981200e722c9acaeb9e7b9df41fcd20de8a3169c2302
SHA512604e55c870302f893ba79432a41da9ba923001ecc7ce764d8372207cc6bcc7a5f7f44f61c14e21415f292d6746a1abe678df3f496b7231b52e571221b8fd1322
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cc7eb27-ff4c-48fe-88d2-6c13905ce21c.tmp
Filesize25KB
MD596ef0380c97220c7a8bd1e84aa6a93a5
SHA14c568f3cecb9e5eb89538dd1fe6a5be7a6e4c97c
SHA256653afbc13bfdf41960d635f702c4006da53e2379b3b05e5897543e2706400827
SHA5128177f441bb32d965773f0448bf8b463783c66e18b6482187d656f959ff83f53cda4deaca768f0900221654f4211f6f26be7f652567b0b7b3b720dcd365bbac21
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD57e9d10779fa68074dc9077183c180bf0
SHA1f8efaf4248f19406edd9423fa41428cc6e88a7bf
SHA256ffe920b563b93f49adaa279d1f326e38700f03651fb0e99bda64159908caca83
SHA5127325fb06d970cec836907b0857761cb3ce17f37fc6e4b5cfa6084bcd3856a87e18053d029cc6267fe8910649660b9b8b65c55b143feb358ba3e9c2aa507a6b66
-
Filesize
5KB
MD5eb3c32a3e479fce7a252fc1965493696
SHA1c919274e4a6d5732aabb83bb8ae69287e5a3574d
SHA256cdd2c91524ea957b17379feca5c490c0afe51bf27a039258f8a1bc60bac01741
SHA512988fbb61b26f7cb25d3bb063e963d36acccbef44a2cb8bec2969894ebc42402f77b479862de6f97ffa994851a21b5165f66055f30cae4bedd73386d19e9da237
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5f6bb1f8faadb347853da7f145ddd18f2
SHA14bd00268b8d612d1df3157fcca13cedcb0669140
SHA256761b21c99880c829a70006fc1d999784ee50e31f7dc9112092e59814773d330a
SHA512cc5c62ff72dc46304ebdab687216d5d6431b4386444772f773e28f8868c34f93a42708479f8d65b7e7c446b79c9a014e7fb37f8c2b928baf85f4868e7f7243e7