Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 20:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com
Resource
win10v2004-20240226-en
General
-
Target
http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 872 msedge.exe 872 msedge.exe 3940 msedge.exe 3940 msedge.exe 5116 identity_helper.exe 5116 identity_helper.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe 3940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3940 wrote to memory of 1896 3940 msedge.exe 88 PID 3940 wrote to memory of 1896 3940 msedge.exe 88 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 3388 3940 msedge.exe 90 PID 3940 wrote to memory of 872 3940 msedge.exe 91 PID 3940 wrote to memory of 872 3940 msedge.exe 91 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92 PID 3940 wrote to memory of 1124 3940 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffcd7c246f8,0x7ffcd7c24708,0x7ffcd7c247182⤵PID:1896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3396 /prefetch:82⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14450439658657369420,1952350099262500382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5476
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3032
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
Filesize
252B
MD53ca870fda45f94eebdb14778748c6bb2
SHA15e1498f8192aacc3ca4fe09f772d7dfbdcb54d7d
SHA256875a8489d3e16d6b485a42584f1424f8ed67f69256163362e983325ff85e109b
SHA512a3dd2ede68d1e3573be71ff1c41edafeb19bd693b1543008e81d886ef17ed74f8acb9317e4681e8d4233d3a4d62bcc753fb6be11502eeed67f7ac0ead6d0f026
-
Filesize
6KB
MD58e7e641b4ad4a067906c0333bec28713
SHA1eb53700f6de52b0c7100470e610b10ab9fca2568
SHA2560f97b9b0c1fca393dbb0a1cc3a9aebc710981ba9068fb63b23bfe41d82c055d1
SHA5127ebebbb0d44c853e8929705dc378996954f8f09efdbe842d9dcb8ddf8ba1bb224e87aac177dd4b0fbf471bdcf783c73f3a46780919618662a49aa3ea8af134d5
-
Filesize
6KB
MD59944cfc2ef45a7a511eff030ba214543
SHA1346faca3f2fd14f4eb08b9e53354cc3a4f84b1f1
SHA25654c1452ac21bbe88534f6b1709f70951bb5e987048844fe7fbf40454931b057f
SHA5120fb7f0eb9beb2841c5e2052fff46744ca90bd2fff2d1e47c8573151224048418efa1cc869be5a4fe5b9b9b6785c9615612359a505b8fb13b0666a1c4fe4c0b69
-
Filesize
6KB
MD5fded8ebe15864cf27f8679c8bb59fee0
SHA18df47bbff921f06d2f29026f4a6f445cbfa29e94
SHA2569c2672a1ddbbfcf5d0573fa6f068f64db504a0ae04ca751603c7c930b821a0e8
SHA512eeaeecc11efca924d0eac11ccaf70d1ac8d9d78e0e77f45c180ae92b409e5a8240211227ba0e6f752c7b39e19c61c99344b5d33305e82caec904fe2912d52c3c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5eadff9467d4ad0892a466c2cf46a1041
SHA1b08bfd8798e7bfd39747ed934f25a3d75b6f08ac
SHA2560ea877f1aba8845a70926158be6207335e12e105c1ba1b40f338b1b1816a3c94
SHA5126e4896a6085b1ef27e08ff9472c9e84e2fdf84722c1e3d65350ff6e958428b7719381020e5b6ca5594471e3cb1321fc82e4bf73733dd161bf5bafbef71f2c400