Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 15:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click.account.miro.com/?qs=d732adec92d8b27861101901015185d9619a1eef45802558d76cc815e64e59388191d362df1e073eb11dd0b8b7e57e57db2e2dc377d92088061da3a10d4efaa7
Resource
win10v2004-20240226-en
General
-
Target
https://click.account.miro.com/?qs=d732adec92d8b27861101901015185d9619a1eef45802558d76cc815e64e59388191d362df1e073eb11dd0b8b7e57e57db2e2dc377d92088061da3a10d4efaa7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4476 msedge.exe 4476 msedge.exe 3460 msedge.exe 3460 msedge.exe 1884 identity_helper.exe 1884 identity_helper.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3460 wrote to memory of 4968 3460 msedge.exe 88 PID 3460 wrote to memory of 4968 3460 msedge.exe 88 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4488 3460 msedge.exe 89 PID 3460 wrote to memory of 4476 3460 msedge.exe 90 PID 3460 wrote to memory of 4476 3460 msedge.exe 90 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91 PID 3460 wrote to memory of 3948 3460 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.account.miro.com/?qs=d732adec92d8b27861101901015185d9619a1eef45802558d76cc815e64e59388191d362df1e073eb11dd0b8b7e57e57db2e2dc377d92088061da3a10d4efaa71⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb605746f8,0x7ffb60574708,0x7ffb605747182⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5223960105552843946,13565142853201174711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD573c8d54f775a1b870efd00cb75baf547
SHA133024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA2561ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
-
Filesize
152B
MD54b206e54d55dcb61072236144d1f90f8
SHA1c2600831112447369e5b557e249f86611b05287d
SHA25687bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD5e9c334b4b2d59b83571abf124ee5c621
SHA1cb62f915c4d176b5442de54c166b08e1fcc40675
SHA25660ed6c4a4be21dc46c76b2d07e641462b5c48a23273f54e0e59252d2b7e75092
SHA5121b21fa9dbca2e8fe88181aeefa60f5fde09d08792e8171420712a6a552e83e950864ac4107e36add9fc5fa992a3fcb56dff632e83e3dd9da11338ef0573d34e8
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
402B
MD595ac8cd88a0a671bf015f2fc998c62df
SHA1ba196e93b0e79e1954aa7aad3b9e13e561482f23
SHA256abd3706b7d83f5d86475579c7309e3b640f4ee0a442963683125ce3bb86650b2
SHA512d310c86bf35cc346deca30de51881af7fc93280cc2ca7ba4fc12c596867682727a81d9a3817f67f7810d653dd3d5e6cf675e7fa5d6e8162b2e9cd77ddf062837
-
Filesize
478B
MD5a0d09369df580f7a568b5dd6f490ca4c
SHA11e65f90c79d7d0582e1f41c643459d76d4d608e1
SHA256ecbf74ca8ef45d00704e99a46be002dfbcf857d5e13797a330106133c9635148
SHA5128f4eaeea623441446ab70bdb72ab8787cab61fb34efa7849704860cb651064e05155f370d9f7601d7d7df72f6dc6b9c92bb0b51114318af019fa3ef8fdfa22e9
-
Filesize
6KB
MD50ce4ec98b0d3e8aaa3c50e2a47acee39
SHA1bcf8b291d10cc92c025e8df2e12ae86420b60d50
SHA256dc3cc57db6c799e00673e87d506976e93bf22e96d9822913d10889d85d8d2dc5
SHA51224a64432abff15c2197b1cb09189e1251dcb202a45f9256a7dcdd92b7eb36d98003501992fff6474474fda7a7cf3ef7dc654da4daf5b2094dc76f40592c8d047
-
Filesize
6KB
MD546dfe32bd0062e44eb1286141bdddb2f
SHA1fa38baf1eb4e7e740eb137d1952f44fae1b81c41
SHA256a29ad57ddf38dc75d2c3226a62a4997f424cf398f743b4281b12aa1e4462b28d
SHA5124ed9be2c37f58af25fff29aea0c53d031245768379069fd9c092c132dc5f344af8006070abca57b01b3c20a7b3f0346f1e4e0850bbdc0abf31efe7fc86cc6a2a
-
Filesize
6KB
MD5b8746ff7a9f62e45dfd1e9041d0a6ce8
SHA1139ab7f967f29a51fb521cd05de8f7d8c216cacb
SHA256bf0d899b12b98d335fb4be3c1bb40b99a6a1bc01e4a05b9fb2cec1d47d901ad9
SHA5127f24d0029c5dc1cc462cdd12805ec275ba9050c4991608b66d82a9d83b06e05b9bee2ec31a7087a31256d2ac8acc8c9dcaec0f5c5cf5169296909325898cebaa
-
Filesize
871B
MD5613ded019d835078645b6efc8ce454e5
SHA124dc02bcf374455233e3c9ed20af60dba366749d
SHA256d8829ca187a3323c09f3072fc42facf3604d22e4b726e4c5cbae01b61a931706
SHA512f838a2c42243fd49e5e4d79096daaa7a59e2731bf6b4ad246cf58de90be2277a9e09af3981f7a54e2662e58c77b76601bbb6766bb72e0b6d3320670c6abaf429
-
Filesize
871B
MD586b48569b492f0a5d4afe336c2bfd04b
SHA1a0e1c3e579b8a799d1837833fb69ba865d6bd2fc
SHA256d824fc7b0849ad02367dcf0f0b898dce3cb1d3964975ff1a29650307c1457850
SHA512c685729263024ccdf00352a3706e2bee622ad3ee96b25d81d3ecbe1d1e972c0ab22a9b17c6f582f7d2a350bb3656199394a6620d09d440901a3e5991d0f82199
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD541d260f5836d6a63d1c8fb7c072223ce
SHA153efff2175aa9c8e53bb7635776ed05593818b5c
SHA256bc3056c8f186a8313d7dd11baec59229d0b859c83ae2f1a653efc7e97a0dd94c
SHA512c3afaffff744c18f959234ebfbd4f55a3216bef29ede99e77ef55742ee4b2953d1037858a07562c26629d6e8e3667609ca2036c6991b8a79e24f28baea485474