Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 01:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://7805 TO220 package voltage regulator
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://7805 TO220 package voltage regulator
Resource
win10v2004-20231222-en
General
-
Target
http://7805 TO220 package voltage regulator
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 2384 msedge.exe 2384 msedge.exe 3260 identity_helper.exe 3260 identity_helper.exe 4100 msedge.exe 4100 msedge.exe 4100 msedge.exe 4100 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 3108 2384 msedge.exe 84 PID 2384 wrote to memory of 3108 2384 msedge.exe 84 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 3000 2384 msedge.exe 86 PID 2384 wrote to memory of 1368 2384 msedge.exe 87 PID 2384 wrote to memory of 1368 2384 msedge.exe 87 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88 PID 2384 wrote to memory of 1812 2384 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://7805 TO220 package voltage regulator1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff20d946f8,0x7fff20d94708,0x7fff20d947182⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:22⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,15987421033628853852,10032006890270828649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5584 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e71d66ce903fcba6050e4b99b624fa7
SHA1139d274762405b422eab698da8cc85f405922de5
SHA25653b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA51217e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
-
Filesize
5KB
MD52f60bbe3f20ba962353b1d86474d5565
SHA1ad9764c6a4d6a0dbc4cceb1b8e76993a2ad6a9ad
SHA2561f44c42ccddcd7644fc63b7978b1af7484ceabbb5e43c06be40ad737643312ac
SHA512af20b58b7ce88aff86d6001ed9de4ec8a786c3089d0ea1b5500a07c53392330f169e4403a6dcec727b753ed3aa2f6a1db50a126742e7af4a6a5c5084531fab3c
-
Filesize
24KB
MD51b1b142e24215f033793d1311e24f6e6
SHA174e23cffbf03f3f0c430e6f4481e740c55a48587
SHA2563dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
SHA512a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad028b05-bff4-46fd-83ca-ceb4687a9e73.tmp
Filesize5KB
MD5022f98b56ae8e6fbbe7a4748b9604ef8
SHA1134cddb62052c3ad52a827ccde5dd02fa7b66efe
SHA256a3df7b2c44048a0f6148dc509e6abb149733d2001e97f4d24a5fc566bf230873
SHA512e4a24cf081102825c770358971dd6deb24900c03b3b0d27ec72500dfc5dff1568a3292c1adff25afaa56c0c828ddbc52e3505cd23218170485192e4185e7f361
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c11391e9d426c7054d812c16ac881517
SHA1c9751f550dd3c365eb2e14f3542adf2356e6f68b
SHA256759234ddf7ed638a0a6ebfdf844209115c253affeff7ecfa17993caa1f5d7ba7
SHA512cb88348bd59e409b8dae772289a4d49e203fd1e02d027514c0f97feba44c03dcc31724a1c196d6fe1a57c66370b8b70594eab0c4372ccf0d51a93020c67f5844