Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 20:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://terra-inversiones.com
Resource
win10v2004-20240226-en
General
-
Target
http://terra-inversiones.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 4984 msedge.exe 4984 msedge.exe 6060 identity_helper.exe 6060 identity_helper.exe 5684 msedge.exe 5684 msedge.exe 5684 msedge.exe 5684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3636 4984 msedge.exe 87 PID 4984 wrote to memory of 3636 4984 msedge.exe 87 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 1820 4984 msedge.exe 88 PID 4984 wrote to memory of 2392 4984 msedge.exe 89 PID 4984 wrote to memory of 2392 4984 msedge.exe 89 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90 PID 4984 wrote to memory of 3136 4984 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://terra-inversiones.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc26dd46f8,0x7ffc26dd4708,0x7ffc26dd47182⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3196 /prefetch:82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:5308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:5284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16048172800973154551,14306579289788492341,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3380
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1796
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c8 0x5041⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5ef1428581ea5a6c216325734cc4081a1
SHA1d5ccff73d3ce285ea9baeaf42bc68f8d4a31dbaf
SHA25653641d9260128b089b276d501c0a60522360398acb11949a000232a9139f8c48
SHA512de3d7ed0284ebaa254e94a9dc9343bb70f3830bc2053f16b2db702aa3e19fb8103fec9eb16ab4027c7dadb90b2484535543dfb078d80732514b8809fde4614f6
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD55f397a6699da83e84dd34c1bc099e447
SHA137f21eeb34a45aa091aa9d452523eb322ddb0e86
SHA2566d8638a7ebead60d2f038a705552d6d4e6f2af2498752cb9ed7eebe8602afa7c
SHA5126b5a70f9815634b6c871ac5100c9efc3d19a92efb20454d293c0e8c05a26c6a6920b7287d002e1d86bd7caa939113013f4c58c1a331f1c3fc01931ad853168dd
-
Filesize
3KB
MD58ce1f0c288cf107638711521400fd912
SHA184c5f3c9d26cb500114236cb61df9e69029285a8
SHA2568dca033f276d9e53e7f200a125226b90d6c0f69434e3697cf3a334297a536615
SHA512af230eb3cbbff7be8ddb3e4b78fb93d32ab44f9e5f66f2fb9901aa34085341bcc6e0e2d9584e47980114764a354bd7bb3db51528dc24e41e165f619df660f8ed
-
Filesize
3KB
MD55fcb8731c3d2de7a962d132372ac7c23
SHA1a60f6e3e4b04a07ce3fab56964cac6cbbd8a1d80
SHA2560c6571bfdab67e069409020e3ca3595245a6a978fb85dc1c3600589f68d957a3
SHA512f8c50e2112110a669b4a54fca13111f1a9e316064c5a3037a95218890ae31dddc64eeeb9444a024d65673799ffd5454adbd43c696a26c9ba85f69178f551d6ea
-
Filesize
6KB
MD5bad6c940e52310ad5a8dc71f21ddbd44
SHA1ffcbbe7353a2b3f4dfd701d045efaa4214fcd1d2
SHA2567e02d0504aecd9fd723663ee36ff5f17987fcd25b4b091d131220c5b34f5b09a
SHA512d6032b7e5b4ee7376361da48251949aa5c21a964c1e77f7afce7b0c072017c204684a192771a7fd346899e37e91353f819f548130d4ff4203beca0525b2ca58a
-
Filesize
7KB
MD5d782d540f602d39a64133b7304088534
SHA12dcc716c157d5ce4cb229ee14a765263528ab169
SHA256d4d89616fd5ac1d87fe3b54f9c9a1326b04a1a3ef5f0751ce60d0dda1f7057ba
SHA512b90bb6c8333384a84c94efd097837a8ec77548dcd0e15409c0f074f1de66a3c2d41c45ade3994c5f84c8505550102adb13c8309bb0566a0ad4c1ee1705867e12
-
Filesize
7KB
MD574d823ce37fbdef43e88cae85aad9a33
SHA1e0e7608766314435f4a98ac7bad3b2bdcf6c4f0e
SHA256f8739c7fd5d8dfa7474eebb9957f2afedc9a20a12819f0074eb728a190e0a344
SHA5122a033463fdcea9351c53891d2345bfd887aab2edf699c4555d990faf90ce0bead1a6af5dcf0be014a8242a14fc4e33829baaf7a23a41eba318fd34e25efa1ef4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389