Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 18:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://10.12.1.179/
Resource
win10v2004-20240226-en
General
-
Target
http://10.12.1.179/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4908 msedge.exe 4908 msedge.exe 264 msedge.exe 264 msedge.exe 2368 identity_helper.exe 2368 identity_helper.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 264 wrote to memory of 4688 264 msedge.exe 87 PID 264 wrote to memory of 4688 264 msedge.exe 87 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 876 264 msedge.exe 88 PID 264 wrote to memory of 4908 264 msedge.exe 89 PID 264 wrote to memory of 4908 264 msedge.exe 89 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90 PID 264 wrote to memory of 3224 264 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://10.12.1.179/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7ad346f8,0x7ffd7ad34708,0x7ffd7ad347182⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:12⤵PID:5720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:12⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10747290168293119388,18319034296742745431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:372
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
180B
MD542eea3d789ad8d8f68e53cca4cab511d
SHA163d1b15db47d8e3ce0af33cb9af1359f3c98c8b5
SHA256fac4a5a322ea932e685e7d5fffc1f921a125a190d4b279239b9deecd2a3d042b
SHA512dcfcd6c7b017898abd7af74a9da1acd62dd43d84be15163160d9eba60229ee6d4f750bc5006f348a982871504f2f7b99ac6b5f6296c7cc6a970b05970fe3507e
-
Filesize
6KB
MD5fedd4b320ea9131d4fb1d74184f539ec
SHA1fced3ac7ac7dfbf866e31ff6e40a9e2e8b7673d0
SHA2566c269d777c2c2ef19effe91dfeb1e3300aacaa282bfdd5c7ddf04a50d350869c
SHA5120b9f23c8834059359c807bc3380696169cf445e66c301b2de2a00ad02bf9e607f9abed36338cd0e799225860374af31e6d2818820173d99b0c63f252c82b35ce
-
Filesize
6KB
MD5d83f9f16b84094fc7a9479916248811c
SHA1682ef16b613f4e5cf46c125fc7135b592be0f809
SHA256232b80dce0950a3d25b09932e79ff8260fbc7b5f3f25c641837d9aab79571a64
SHA5122343a1abee891a6e877455e38f0fe7ae880fffc36915f91ee0faeb63c9f7565fe4eff3a34da65fb766c393c59da1e516ccfdfc08233732c8fe338cb7b985c91a
-
Filesize
6KB
MD560cfa6902c9a3734d2bf509b540385bc
SHA1f5055c058f37f703b973988fba8adc2542328256
SHA2565f9c707e6de12880a99b35144197343fb4c7a180b8a3a16cbe9cc3695ce67bf7
SHA512b1112a13920798a4324ecd6d7b8817262401b179601273a9ebd7d3547a7c975321825fbe11ebd720d496c83cb52929881ff8e7407ae03cb7db4e97ad0d901522
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5389b74acedc8e2974197e45f09774c49
SHA1fd5f77a5dff813a4a0c9cfad68987e9dab84dd33
SHA256d7a14596e15579278cca36e4bc0aea830bf0c1438a3b63a78edc0a15f54b7161
SHA512d0e0daee0b20fd4cf3cfd226de187cca9516dcd85afd8bf4650b6c4b2a9950763a26c0e447bf600a5b24d5a7ff312fb0ff40511ccf7da0a034a893df4b5ef29f