Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 21:05
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://q76y71yn.r.us-east-1.awstrack.me/L0/https:%2F%2Fpolo.feathr.co%2Fv1%2Fanalytics%2Fcrumb%3Fflvr=email_link_click%26t_id=65e889b89c1fbf3ce8ba2e1d%26a_id=62bddeb6da9b589bfb3dd4f8%26e_id=6501bd4d93a32da1fe37ab44%26cpn_id=65e889b89c1fbf3ce8ba2e1b%26per_id=62e94576ef44525d8e5cbd37%[email protected]%26rdr=https%253A%252F%252Fwww.afsinc.org%252Ftradeshows%252Fmetalcasting-congress-2024/1/02000000e75pdgho-5fj9974l-hjve-vo2i-5ema-1ls4b0eoic80-000000/KSKi82OQ-UeWhtor4VBexz3VBmQ=364
Resource
win10v2004-20240226-en
General
-
Target
https://q76y71yn.r.us-east-1.awstrack.me/L0/https:%2F%2Fpolo.feathr.co%2Fv1%2Fanalytics%2Fcrumb%3Fflvr=email_link_click%26t_id=65e889b89c1fbf3ce8ba2e1d%26a_id=62bddeb6da9b589bfb3dd4f8%26e_id=6501bd4d93a32da1fe37ab44%26cpn_id=65e889b89c1fbf3ce8ba2e1b%26per_id=62e94576ef44525d8e5cbd37%[email protected]%26rdr=https%253A%252F%252Fwww.afsinc.org%252Ftradeshows%252Fmetalcasting-congress-2024/1/02000000e75pdgho-5fj9974l-hjve-vo2i-5ema-1ls4b0eoic80-000000/KSKi82OQ-UeWhtor4VBexz3VBmQ=364
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
flow ioc 85 https://www.linkedin.com/feed 85 https://www.linkedin.com/feed -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2908 msedge.exe 2908 msedge.exe 1776 msedge.exe 1776 msedge.exe 3156 identity_helper.exe 3156 identity_helper.exe 5492 msedge.exe 5492 msedge.exe 5492 msedge.exe 5492 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1124 1776 msedge.exe 89 PID 1776 wrote to memory of 1124 1776 msedge.exe 89 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2092 1776 msedge.exe 90 PID 1776 wrote to memory of 2908 1776 msedge.exe 91 PID 1776 wrote to memory of 2908 1776 msedge.exe 91 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92 PID 1776 wrote to memory of 2660 1776 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://q76y71yn.r.us-east-1.awstrack.me/L0/https:%2F%2Fpolo.feathr.co%2Fv1%2Fanalytics%2Fcrumb%3Fflvr=email_link_click%26t_id=65e889b89c1fbf3ce8ba2e1d%26a_id=62bddeb6da9b589bfb3dd4f8%26e_id=6501bd4d93a32da1fe37ab44%26cpn_id=65e889b89c1fbf3ce8ba2e1b%26per_id=62e94576ef44525d8e5cbd37%[email protected]%26rdr=https%253A%252F%252Fwww.afsinc.org%252Ftradeshows%252Fmetalcasting-congress-2024/1/02000000e75pdgho-5fj9974l-hjve-vo2i-5ema-1ls4b0eoic80-000000/KSKi82OQ-UeWhtor4VBexz3VBmQ=3641⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd14b346f8,0x7ffd14b34708,0x7ffd14b347182⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17914813884825028769,3171035811122939143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2988 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5492
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4020
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD517a9edee5e71957505a04e020f9885b3
SHA185e89de6b60b2f1c312c590f390ce605a9daf232
SHA25644c27d7dc31b25c347fb7c6351844370edb65b2ac3768b0d674a6c19c71a168c
SHA5126ebd8e5132f5a897c3ac68e05ede37c7500f25179b5071cebfefa27eb522da64e6f034808b070b6e14cb46e0e42edb69d7df22cd0e03c4e8d761523a2e0fae42
-
Filesize
2KB
MD58a04d0c6d7d60063c46c89ba23cfd7cd
SHA1f1aacf070ee49d898d7be18e52c358dcdaaf8210
SHA256a0e2f606e584c7dbcc56a027cba55d4b778087f6de7f4ca3a349cfb806fd5290
SHA512c977c4dd1b3a43b3e08376a8bf676df0e4a84801082e80792481d281be94af57d987de9f18fd6d583bbc66c1f1e6df31906150b118e7d3f877b53bf69955d0a6
-
Filesize
6KB
MD501033872be7b97f9d18493de63aec327
SHA1aca2efcfef7b1d7344d69024430dce7e70191c8f
SHA2560f96f4573a9d33f3ff7a5cbec8c9838479efab70da476b7926b3516d0b792f14
SHA51245db452b9a1c4e0e79a931256312664493fa11b2ec8a766a205749d0965e6423bc59ace397419c6049908d3962c0bc77840b7fb084538724ac7196e8336d6c78
-
Filesize
7KB
MD57c91c0569e7f2ca658122d3c2f444a27
SHA1eb92d86f193e38652c85a8eb9cfbad7c4790884e
SHA2562687da264927afcb40ca13d03210e79df125b57b7be24b54125451c53ac8b6fa
SHA512a979f5caeb5b10f286dfdca29263229d34333dad3b226d018fc73535e786134bb281f7985840199dce8c58219d07b7fa086c75eb2047cc6f841975577c5462fd
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD59ea88504516e82d686e73199650eeadc
SHA1fdf5a83e38949b07e43940e98574547712612dcb
SHA2563575f06f4b936b7c9de4d7b56fcac972526651d95d6ced15e4ae9754bd4903e3
SHA51230fad2c629bb59a41bc4a53e40370b37a4452f5b797a3300bab0a18b3a492b08597145d7dc0abb7a82392f4fae479baa7045047829125bc88b61eacafc03e020