Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
241s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 13:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tarathow.com/gtbnrralal/index.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://tarathow.com/gtbnrralal/index.html
Resource
win10v2004-20231215-en
General
-
Target
https://tarathow.com/gtbnrralal/index.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 5028 msedge.exe 5028 msedge.exe 4800 identity_helper.exe 4800 identity_helper.exe 4604 msedge.exe 4604 msedge.exe 4604 msedge.exe 4604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5028 wrote to memory of 4172 5028 msedge.exe 68 PID 5028 wrote to memory of 4172 5028 msedge.exe 68 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 5012 5028 msedge.exe 87 PID 5028 wrote to memory of 4720 5028 msedge.exe 86 PID 5028 wrote to memory of 4720 5028 msedge.exe 86 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88 PID 5028 wrote to memory of 2348 5028 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tarathow.com/gtbnrralal/index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc913246f8,0x7ffc91324708,0x7ffc913247182⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9258241834635010313,7167058408084617844,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eb20b5930f48aa090358398afb25b683
SHA14892c8b72aa16c5b3f1b72811bf32b89f2d13392
SHA2562695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35
SHA512d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8
-
Filesize
180B
MD57d6ddf210d00a17d6e9efb0406f33a21
SHA1991c58bc4f6b305f614f87402eb319325eed724c
SHA2563515e2397b268eea6cb3f263dab03baef0e38322e5d26beafa78a7dcfffbccee
SHA512ae0d7b56b3a1ea490bc89c83b2ae41f8a3511bc1ce84819ef28b7932dccac25d353184c40deebc1cc8fa488810a2312c9edb10b4a8089db7e697e7428b4d2f4a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD55d5bc3509c1b79d29a9a4fce9f4ee425
SHA1fde2349ad728dd3d2a10472395d2a355e6016ed3
SHA2565116e6f8c26e4f94e6b2ab5427baf9386b9834b9e916ebd86af10f03d261c6e9
SHA5124414d5f3c99d23826c4b86d7bc349ed94bc322ce0560a4807a97e53c487238c811c17c9eceb8843c9b2ca1e6c487724c7e001c3a52f116eb5bd6bfa28029fe5b
-
Filesize
5KB
MD5d56f0b244bbe1ef31a5e0ec5656a1fdd
SHA155bbaf2b735af895a0088f678d2d1c0b3c2aeea2
SHA256f687abd27e8f78f7217302820fc7d8a2b10b9dad323e96f3963b74eedf323b14
SHA512cf8407a357c2f142c355e91936ac6fe0e76005999d0b5cf5f930fd0ca3c646f2a09ebadcaea17f2b1c5b97003b6b9634373be5c461164d513f8588d8c579658b
-
Filesize
24KB
MD52bbbdb35220e81614659f8e50e6b8a44
SHA17729a18e075646fb77eb7319e30d346552a6c9de
SHA25673f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd
SHA51259c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d723cee591f4b30be442c95003b14245
SHA120d43df752fb1cd5a82faed8d63860907f500305
SHA256117a4d91c57c58b9a76a9b5510e36010482ed9232a4f4b374e001736c6cf0652
SHA512c52099c09aef1c81577136b1fe7df3f8a0c579993fd21dc760fdbe3cb636731ab813c67cecff28d6c604fd90a4b0071f2f9c0fcbee2d8be29fc66d7feac90df5