Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 10:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.bankofamerica.com/electronic-disclaimer
Resource
win10v2004-20240226-en
General
-
Target
http://www.bankofamerica.com/electronic-disclaimer
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2832 msedge.exe 2832 msedge.exe 5032 msedge.exe 5032 msedge.exe 4424 identity_helper.exe 4424 identity_helper.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1140 5032 msedge.exe 91 PID 5032 wrote to memory of 1140 5032 msedge.exe 91 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 1152 5032 msedge.exe 93 PID 5032 wrote to memory of 2832 5032 msedge.exe 94 PID 5032 wrote to memory of 2832 5032 msedge.exe 94 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95 PID 5032 wrote to memory of 3268 5032 msedge.exe 95
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bankofamerica.com/electronic-disclaimer1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff850746f8,0x7fff85074708,0x7fff850747182⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:82⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,18082088393983805822,18384834396977346902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1340
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536bb45cb1262fcfcab1e3e7960784eaa
SHA1ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA2567c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA51202c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
-
Filesize
152B
MD51e3dc6a82a2cb341f7c9feeaf53f466f
SHA1915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA5120a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize552B
MD50e7320421dc1efc1a31de8c21ade7e25
SHA14f6578659dffd7d5357faa96f67ff917f1dc3289
SHA256db9bbf5b2cd70bb420388a8f525ac43504a93d4896e4edb36a0ee0f2c924003b
SHA512f542f8e2068e85bc0c2f86d0b569541d4780d53d32de4ecf4b821d9f4bd956cb976a515b61518d7adc6821911c81ed34b0d3bdde2449c2294c5deb26ea63fd9c
-
Filesize
412B
MD5ddb357334916672c6bda8481e3b87eef
SHA1c94de37d85cdc4c63fd4635bc34580b9c9f58d75
SHA2562725ec5ef3225fbd98afb0338fd86a65fb676f73d305878c491a7756ccd55491
SHA512372e93d1d1d5af2a2966c63ce81270b147f22b6ba2097a3d39f682781579db4899fb0ca166dac69395f5b0b0cf1e896e18ad70e6ca55a656637b6eb11b3fde69
-
Filesize
6KB
MD5f2e013f358d5762a9a11aa7d5ce40c5f
SHA1c403d239bbef702e2741015381e2cd5e63ba5ff3
SHA256ae93a4b6cf26cd0dfe2235c75f1d35860ee2b050b1aec709e8b5dbb3dcf92254
SHA512a5a55474a96651222bc26c08f4c672a752de204e4ca73c476daf4d9ebf4341996b564aa910cab505f40865f00a64b7181ac89826ad1bd00a68f80b14ccfdb422
-
Filesize
6KB
MD5129a8f9ea79774cd991f2a406e5860fe
SHA1056a897e0760ec0bac0f6043ed4762d255cd8bce
SHA256cd0269dd38d1a2761e456f3d5b48cfca19179165d51eed5f31b44f1a3446cf6d
SHA5125620370265c524af7c6349f156365bba08b3489d8094007a92f27ad55eaa9b527ba45f64ddacd56c642cc044a40e7e5eca4ebef18be4e2b18b25792a3b147d77
-
Filesize
6KB
MD55580cf683aec3f2e833b9f717e2da397
SHA1e1c78ebbf8d7563c6b48ab77ff91e189fdbf9a4b
SHA256b01af82111044889db7a8255ce8004937843b5864afc6c645ac97fe3ee4526ae
SHA51209e89fc6aac748adf97639bb23ffcc71217a17cc0a0ceedc0ca1e1526698f1ad9aee8dcca2a9f3219527636b3d51333b22f8541bae4fdd839b6780e223aa7b8a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bc9a92b016c5eb9027eec862079e63da
SHA1f553408bd63583c652ecaf034b1529b521ec1f0d
SHA256d68fcb0892f2c4d26534fee0582ed3bedda4b0c621ef08f8160849a72dba7b36
SHA512797b1a7d5ffe9bc91cf2be59e4dc9508fba1142f5cfa9bfc3abbf2bd3d9590503b482db96e322546e672ef42a74f646c0b22a6ccb77549b21c6c8ad6ac36bbac