Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 19:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://85.239.54.103/1/aa9aac27
Resource
win10v2004-20240226-en
General
-
Target
https://85.239.54.103/1/aa9aac27
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 892 msedge.exe 892 msedge.exe 1232 msedge.exe 1232 msedge.exe 3760 identity_helper.exe 3760 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2712 1232 msedge.exe 89 PID 1232 wrote to memory of 2712 1232 msedge.exe 89 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 4080 1232 msedge.exe 90 PID 1232 wrote to memory of 892 1232 msedge.exe 91 PID 1232 wrote to memory of 892 1232 msedge.exe 91 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92 PID 1232 wrote to memory of 680 1232 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://85.239.54.103/1/aa9aac271⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc788b46f8,0x7ffc788b4708,0x7ffc788b47182⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:5228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9773828644268642958,3767579740756992677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:5236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
Filesize
6KB
MD58c0121ff70024eaf63cbf3daa4212dcd
SHA14a70418c5aad85ae95eaea7d09f899da76e04b99
SHA2565fcd1b2fde2087b4ea94ace028eabe1e150eddae29bc1186b398867d8a609d3b
SHA512822865fa67dca8b511faa200e4785d9cba5fc306ed0489b9162a21ab7d88be1c79557039dc8bcffa51d93c4f77a1782098a21e05acca7e9afa1b8dc0f5d7f000
-
Filesize
6KB
MD510738ffc1a142db6016d856cf830f915
SHA1a62897218ff8567e2ad72181af32a9b057e091c3
SHA2563d49f3ad704b98b84ea60b0eaaa9277e72a6cdcc161e980da55e18bd70936f64
SHA512c1f6401d4b9b028a152d0c4d73683491d59d5b6c5c39c581bd1a43bcdab2ff932380fc698988132fe25daa566ad26af77f33f1861768f997f6b76ed30c18138a
-
Filesize
6KB
MD57bdf51f9d48d434ee625bb4db8573299
SHA1e856123f0a54bbee33a479141b639ddc52e36af3
SHA256fcbeca639ea612e30aaf67f9838c347fc1718b0951d4624a47f545f2fb76bc07
SHA5126f157f92055a6d44fb5d65c406749101936468dacac9794e8fa5df1bf6cfcaba7d54ea079614872e0646e3a4c693f418c2a754c8fcdfe3599838facae179a6f7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD540fa83e7be69b8b0197c855a13ab92eb
SHA1d77bbeb3e8572d24292c39c57feded32ff1b0ee7
SHA256d3667aea5b11360615d08a9d71f9a2a409686015e3af5994a3bd4a2b7a8dc051
SHA5120f696bafac47bdb420a60c079360a6e3eaaf89e3febcb0f5fc3b518c865eada25e9c9736e0b55185ed8051823ef627f89ddc964566390f5589c9ae3c1309e82b