Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 19:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://m.exactag.com/ai.aspx?tc=d9946895bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41jcornerstone.com%2Ftoro%2F70142%2F%2FY2FybG9zLnRvcnJ1ZWxsYUB5YWkub3Jn
Resource
win10v2004-20240226-en
General
-
Target
https://m.exactag.com/ai.aspx?tc=d9946895bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41jcornerstone.com%2Ftoro%2F70142%2F%2FY2FybG9zLnRvcnJ1ZWxsYUB5YWkub3Jn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 840 msedge.exe 840 msedge.exe 3304 identity_helper.exe 3304 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 840 wrote to memory of 656 840 msedge.exe 85 PID 840 wrote to memory of 656 840 msedge.exe 85 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 1120 840 msedge.exe 87 PID 840 wrote to memory of 4624 840 msedge.exe 88 PID 840 wrote to memory of 4624 840 msedge.exe 88 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89 PID 840 wrote to memory of 5092 840 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://m.exactag.com/ai.aspx?tc=d9946895bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41jcornerstone.com%2Ftoro%2F70142%2F%2FY2FybG9zLnRvcnJ1ZWxsYUB5YWkub3Jn1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c2146f8,0x7fff4c214708,0x7fff4c2147182⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2106196449321421220,8306253750463721246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:3824
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
183B
MD59c86620595b8618961614a4b904df179
SHA109e52f67df9a42b1abf4b2d2808d09fe50cdcf90
SHA25683f3884712a77bbec3c3aa68e65ec3b073ddef13a34b627c1dd6d96f122a0c44
SHA5129939d3a4d200bf845187f7fac74131d5ee166babb82492a43b3472b032158a43a9180e4153287f2b3ba56286afffc7902d6c4130b5be7a04bd169fb5c4cb245d
-
Filesize
6KB
MD573cd98e6c0fcc3f67c83322f8dd9a11f
SHA1bc2122a60495dd5ff5c86a458444d7305caf2c93
SHA256ac099fd6a061291d760557f5d7086c8cdcaaa57f650e31dc8215318d258c5963
SHA5125dd24de5b8fe70f84591ed54b0dabc04180b4e4fddc911ed59794089772901ffd6f7c5b45885eb52f69da3cb272d3995e18138b6095fcaccd166595eb12181a0
-
Filesize
6KB
MD50fb6c583007322786dad1f15131e27a1
SHA124f565565bdb57fe2238ed1a4963888d1c90fb56
SHA2566f20f83be4f586a47f360e18a0fd6ff843ce36b2cce3d0e0d97f2bb3af43a603
SHA51271e7ec74e6ffef0b709180f54f20ee832197b7462a8e4226b2e0e7b7d1cb079461bc891d3d8132c3aa4e0b31a09df133dc5efced7a552d163a92005fd67ff3eb
-
Filesize
6KB
MD570763dc9c155d0cfa4a6ca193e0f5f8c
SHA1810f00fd9bd15239ad84da7be1c39e5f70375270
SHA256c994cfa6ec7cd61f72e40d379fedc17a3cae50bc875e2450714eb4cf522680bb
SHA5121cf051652117ece067dfb9525948383918a8c99f10d9aba79a7b23060ae9d6e76de608cd3b5dff95f9d349357733bd1fe2bd970dce103c7c6edd8bab41ac3d6a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ebc1dbb1ba047e3ccdbaa157dba75318
SHA193b54f16dd5d960421221e08a71e45867a80cdd8
SHA25610369b3754d55e3e798b2be9a02a95fd5aded0ae5dfb38df2d7a753cc4144a03
SHA5123862ff02a59af8ae9fc3ee116667f86dffd6df0350bc37e5458aa47c65fbf8e85a1da48f1dbe421be3e5453e8e2c5dc1460bb69a948fb81cdfaf227d051e8f9b