Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
110s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/03/2024, 15:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://xmh57jrzrnw6insl.onion
Resource
win11-20240221-en
General
-
Target
http://xmh57jrzrnw6insl.onion
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 788 msedge.exe 788 msedge.exe 1244 msedge.exe 1244 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1244 msedge.exe 1244 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1244 wrote to memory of 4904 1244 msedge.exe 80 PID 1244 wrote to memory of 4904 1244 msedge.exe 80 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 2572 1244 msedge.exe 81 PID 1244 wrote to memory of 788 1244 msedge.exe 82 PID 1244 wrote to memory of 788 1244 msedge.exe 82 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83 PID 1244 wrote to memory of 1300 1244 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://xmh57jrzrnw6insl.onion1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9467c3cb8,0x7ff9467c3cc8,0x7ff9467c3cd82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,2681672454970209470,4005590622595780261,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:22⤵PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,2681672454970209470,4005590622595780261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,2681672454970209470,4005590622595780261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,2681672454970209470,4005590622595780261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,2681672454970209470,4005590622595780261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:12⤵PID:4472
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d459a8c16562fb3f4b1d7cadaca620aa
SHA17810bf83e8c362e0c69298e8c16964ed48a90d3a
SHA256fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a
SHA51235cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f
-
Filesize
152B
MD5656bb397c72d15efa159441f116440a6
SHA15b57747d6fdd99160af6d3e580114dbbd351921f
SHA256770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab
SHA5125923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c
-
Filesize
5KB
MD5c7d54a2fadab8c6c9c53be03e9c3101c
SHA15909b5923afffa8da83e626d0089b151173e9441
SHA256517f30de28673d4492bebd2cbd5a6bfca8674a875a8107b200e6fbecae769b84
SHA512d3e1d0ddf4fbf7d84bb3eb04ae859af9d4f5b3ddfedc3a39ef689ecdacc01734e89179e75b80d6ca7372c409ace6109d143220e4d0d869a7a2ca1e1ff576d530
-
Filesize
5KB
MD56ed5d2de42f97c07d34e07ef62696f4f
SHA1fdaad4158c0f6fe2b1e85f6922cf90d3ba1d7bae
SHA2565f69b870ec7e6b142beae0b4661fe0b1886e002dfe8af47d1af2a5dba28c1b44
SHA512663f204f57dd3fc3b5d94460fba561dcf8e61f37395be9bcd8b5307871dd882e35d35efb454045a4def5397ac16185ce554f3b2b6828f9a55281aba01be46c12
-
Filesize
11KB
MD5926e9c062fd23e89c304b875a7ccd2b7
SHA14b01fefeeb2a9debbc663d45b85289da35942751
SHA25620b316a440fb7cb164c797f9c2db5ce17e342f5782c3267005853ed7940360ee
SHA512479a6b0a9c08fa33aaf08a46db76a624221b49910ae080cbad3501b555c9b814a586020a8cb930b1f1141fcc3ac41a05e29e02abede894ee5be505053b25466c