Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 11:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://swi.org.lb/donate
Resource
win10v2004-20240226-en
General
-
Target
https://swi.org.lb/donate
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1136 msedge.exe 1136 msedge.exe 2796 msedge.exe 2796 msedge.exe 228 identity_helper.exe 228 identity_helper.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1216 2796 msedge.exe 90 PID 2796 wrote to memory of 1216 2796 msedge.exe 90 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 3860 2796 msedge.exe 91 PID 2796 wrote to memory of 1136 2796 msedge.exe 92 PID 2796 wrote to memory of 1136 2796 msedge.exe 92 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93 PID 2796 wrote to memory of 3256 2796 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://swi.org.lb/donate1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ffa7fdc46f8,0x7ffa7fdc4708,0x7ffa7fdc47182⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:82⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2875244714337069533,7338138419146014619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1772
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\270ce455-38ff-46fc-9a56-ddf53a29b7b0.tmp
Filesize1KB
MD5a1a3722470dc4bd47055b0662f5cb0ad
SHA124d07ce9bd1699ae273bdf17ba4cd87482647638
SHA2568a5f0dac1983caeca748690f6e88b973a323116de946770210b475ddb3f820ba
SHA5120c7f4c000963796321096bdc97574222eed8d84ad3db275713beb703641b3bd8d0ec91c86a262e75ac80963e4adeff6cb6cb3a0266a55e230d84deec49287a64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5db72c26a583603e29a1a1b56694a4197
SHA1a329ace456dd41f899458d33f485586a91f19484
SHA256eb3b267b3a011c93b173abbf0e95564fcee69d052c027580c4388e1309b9eb5f
SHA512298424f0d586096de54a88ea28aa48639746d572645585e019f9f952f3eda94d2c5bb63c7bb08f8bff929806a9d8a658220850977a1275d8afd0b27c67575ee9
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD52b0a79f4ac8c9c6bccf8231d03f42142
SHA183b8cd7de6cf70b192b53fb684d990cfe5c4ade5
SHA256cc4525c6f9792d1958f84cf6218b19c7f113c3c29bc417aeb361a1f77ae54ec1
SHA5127570149026ccf8602972f628cf1eea673fd05677c8951e9d7811fbd36f2c04e744afb7f1b285eb652df7e18b59e1a05af7e4ed8d2fa6049b43470c9d621b41fa
-
Filesize
6KB
MD5623a2cce4107edf593ac77fe169e0c7f
SHA1ff523b084c831263a22342b45eef49834d47b014
SHA2562a1c118c94e004693225a2065d648fb48596d1c1c249f5d08c3b4d9ac1a7625f
SHA51244c021f6df4658ac6552299fd70cdc5d24a2ff29bfc51d4daa7a1340ac5d84bc530c37fda2daf1ef13045e9dc94011a6b83d97dd038059c426adc8c1ffcf5620
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD56d00c696425bd900341309e6b819f8ac
SHA1ddd3f1404770e0672e6a54a545e3d233ffd77ede
SHA2560be9739e5958430c20efefeb046fb30b7a5482e0a5b08567b95dfe9ce9e4f91f
SHA5121218ed0e08706b35687ee8151363869b646ad4fe14bb83635b3620facec73e2eadad66f820729382646413cf0f8f006d55524b4b557014ea0b78b55e3c386491