Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 08:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://stomaf.pl/
Resource
win10v2004-20240221-en
General
-
Target
http://stomaf.pl/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 548 msedge.exe 548 msedge.exe 2156 msedge.exe 2156 msedge.exe 4500 identity_helper.exe 4500 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe 2156 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4200 2156 msedge.exe 64 PID 2156 wrote to memory of 4200 2156 msedge.exe 64 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 3140 2156 msedge.exe 92 PID 2156 wrote to memory of 548 2156 msedge.exe 90 PID 2156 wrote to memory of 548 2156 msedge.exe 90 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91 PID 2156 wrote to memory of 4556 2156 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://stomaf.pl/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff955046f8,0x7fff95504708,0x7fff955047182⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,525317978450640459,4392846461763473884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:1848
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4372
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e189354a800c436e6cec7c07e6c0feea
SHA15c84fbda33c9276736ff3cb01d30ff34b032f781
SHA256826adca1e688de79a3ec5b91c75990927fb2a33ae717f474608c68336053f427
SHA512ceb069a5e83a634503e253846fa17b8bf7aaa539c3353ce61251633d69068e24c5eadd1b496f43058790d2b513e65d2c0b0213730813d0b58bb82a00596e05e4
-
Filesize
152B
MD5b9e3e150cfe464e9ebf0a6db1aa5e7a2
SHA13cb184e2781c07ac000661bf82e3857a83601813
SHA2562325a6292907263d1fb089a09f22fbcc6bad56f4961d427efdef1abaef097bcc
SHA512f5eb1e76eb9441cf5000d8d4db9296077b61714ead5012779c084b37f4bba07614055738f5dce69b13b25975d9b7c03eab049b7685eee09b23fd8d4a7d71a039
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD544caa56aa6c58c95c9a1ec078a3e418e
SHA1af07c5449279703092e9343c209149627dbbd0ed
SHA2566611ebe2c64fac85f59e714c02243f5523c4690638e2cc87d3e7b5755f809f9b
SHA512e1db4b85c3041f0483893a9972d44261efd3ff1b0f2f7f586fede50c014eba40e742090466bc9dc489fe557e8fedea6934d042c129e690e68f6463b9eaec86ad
-
Filesize
6KB
MD51440ba1a4838e2496494611551b59e3c
SHA1c316061a4b7b9d5b4c28895fc44c589145866045
SHA256ac87c260a95353454482b139b23291e0006c02f2951535cc67d43dee93551311
SHA51293156fcae086a832f532c767b138c52292c105459d8bcc7cf393cc9421ed2c118bc57c75ce797456f8bc99d02bbb634130c9861867ce2996d549f6fe9925fc34
-
Filesize
7KB
MD5fd37688a75a7bec5fc4d1df1c302ed15
SHA114a5f6b42c14871020ee6362bef2f1ef004fc7e1
SHA256f0d148cdc141582ec87d24aaa8396beff6cf2a6593f3e4ffa343eb8e2a8f29d0
SHA512ab265eb685ffe36812d4e84c1272f9256e3799b3b001b81af6dd00d2e1ffb13a131282082ddbaae47e62ed83774a2b20853d034f9e5f5c53f041279311e0e2e1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD556547d2409a0d08c6b4d4eeb9c1eee89
SHA12abf94831afef39ec23b12a9b1cad8c61917b1e7
SHA256f86873628f1e26ce6824e733fc64a7464f5396b64d88a7a2477944adf2baabed
SHA51280e82c41966da2da3dd7d3fc4bd7135c36ac81663a5a11c10a1b66a6993f281aa48763ecccbfcc46b7ded13b942f837552b66e7643212e9ce0c1399b42160d58