Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 18:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamunlocked.net/
Resource
win10v2004-20231215-en
General
-
Target
https://steamunlocked.net/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2396 msedge.exe 2396 msedge.exe 1100 msedge.exe 1100 msedge.exe 4088 identity_helper.exe 4088 identity_helper.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1100 wrote to memory of 3436 1100 msedge.exe 84 PID 1100 wrote to memory of 3436 1100 msedge.exe 84 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 4612 1100 msedge.exe 86 PID 1100 wrote to memory of 2396 1100 msedge.exe 85 PID 1100 wrote to memory of 2396 1100 msedge.exe 85 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87 PID 1100 wrote to memory of 2188 1100 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f14846f8,0x7ff8f1484708,0x7ff8f14847182⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3740029639144700540,16188202482994701463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD584381d71cf667d9a138ea03b3283aea5
SHA133dfc8a32806beaaafaec25850b217c856ce6c7b
SHA25632dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
SHA512469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5c9a74fdf95583644f9dbae0f8cd81e83
SHA1dd7267d6c635c912c131678bea12e0ea87cb4d47
SHA256207e89ae538463a6b3df727cf9feb6c85be45add34fb5528baae62b5a764e82c
SHA512dccd1f03b5d8fbea8b4c9badeeafedc9a60a9d6a45e74632db98abfff69a11b2b5faff78e1a1b2368a73ef710803bde863067566fae6345feececd3a445a15d8
-
Filesize
990B
MD5325ba04e18818e2dc5e6e0b9a4915e46
SHA1321536fda2aea6f81c35074293e92b531ff728f5
SHA256800911b39fdacc7dbdbee5b35ef4aa043ecc1b333e632a0d26e2f77983d55a49
SHA5129b6e8f2743c47f1e74b53856d82093e8ab337401416f2eac83cfccdde1971d6337e799577aa66057ef0d76c9108163046e3eccbc9a8964ca29fe74ea49fc1024
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD511084ef21f9084572a24ce2f3b9dfad2
SHA12f7bd6debb7a2ecc4c67e4db5ed6ebe9672cbd29
SHA25682940ae174d7fcd5bc1161340c62571459bb7d1882ef717ac200c1049dcc7ead
SHA512657c1dd748d2df817b445186d9cbf49ab0d6d303d1a47440d440e467e8f5eed56dcb5c60be31b75b7b6ef4660a0756eba2d7524093ba249d2e4a177a4563b8d0
-
Filesize
5KB
MD5624e2c25fe648b512cca115432b46a5c
SHA15b0b4d6e1076a38782b4a4ea6296126e7f17e772
SHA25628f451ddd35873b6878f0d2a8448e97bdcd1169a306b193bb2f4009813738619
SHA51294afc90428ebca38388dba3466cc67e8079f9e301e4515094eed52b3e516ab8912c0c9dcc497d79161be873e8a08212fcf9a347b700731e13f3f7949664320d6
-
Filesize
24KB
MD535f77ec6332f541cd8469e0d77af0959
SHA1abaec73284cee460025c6fcbe3b4d9b6c00f628c
SHA256f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7
SHA512e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD511f5fc0846107dd4fcc234afc331ab23
SHA156db02adb579d7f546039752461d0c6be8dbd09a
SHA2567e71297f9d6b5a5632d7d939a188915c500311ec1d57a11476d592f5f7a61b79
SHA512646eb91c57291f725bdd92594ab1c9474743e9c8ec322820483991865a5ce20b2e9103db6901e775e623d6ad4bec86cff1847fa335df3918439c916dbcb58899