Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
591s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 14:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://edpuzzle.com
Resource
win10v2004-20240226-en
General
-
Target
https://edpuzzle.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4208 identity_helper.exe 4208 identity_helper.exe 2012 msedge.exe 2012 msedge.exe 2012 msedge.exe 2012 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1988 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1988 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4536 wrote to memory of 1724 4536 msedge.exe 89 PID 4536 wrote to memory of 1724 4536 msedge.exe 89 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 4944 4536 msedge.exe 90 PID 4536 wrote to memory of 5040 4536 msedge.exe 91 PID 4536 wrote to memory of 5040 4536 msedge.exe 91 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92 PID 4536 wrote to memory of 2440 4536 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://edpuzzle.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6ae546f8,0x7ffd6ae54708,0x7ffd6ae547182⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4200 /prefetch:82⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1352
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2444
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x448 0x3381⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize864B
MD51873aaf8bd23294fd889bf3cda0a0c77
SHA1f5b471effe7e6344f108fb5ed0ec0d37109987ee
SHA256924dbdecdc03df5137c945da81147b4dc739a8103578d9fd24b722ebdedb2733
SHA512169b4475140b3908a7734428b4300b33ff3fc9ce8f7bed007b4b805f3f38ede870205ae60275c6e62c6b8594601c64cc5065e028137006ebad6333e08eccf033
-
Filesize
1KB
MD599c08fc8295a7b52d07ad695bca53b54
SHA1f25eb45a620cd3b7b344b026ca7a057195727160
SHA2569862f0818f1668c89b24e3031738b3c977882aa7f3d6a0e1d317e956f11008f6
SHA5122c09b8833b433a6178dd2868b6b4790491f9a904b6519b281a561ba9997e7a67d2bc35cc332f1c33284dbbaa6bf3ff91c7736f53516d054ed887ed0492a3f228
-
Filesize
6KB
MD5be429a0e19af9918532a35d5da73747d
SHA1ecda6e51ee9632ae81c809028379349f0e9dbaf6
SHA256161ebd76c419f7e6a868b42534ee15a4dc359156c81774bfe6c85542fc041fd1
SHA512114f0c614ff2fd732887e811566e59b17e0e56c2524bde2d3258caac8267ff2576ae3376208062d9e88207271401082dc831736b81247140087e2d7a7f623652
-
Filesize
6KB
MD505144e3d31affb9b79a5b7af545ee68c
SHA1c4eb193914376ad930c4abb5265197b287c46eb7
SHA2563b8f2c7fc39afb8af734b86af04da1891f0b17e077fb32abccf762fe37eac510
SHA5126eaaafe85b81d9d00b0fb1f1c8fd7c78bf3b5403058e77aae82e363130870f8273738b8441143b06bfa1ea86ebb8c4ddffc1dd2b376cd92817945c4701c4ab85
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD503eaa81ac01b9008694e0e3319e1dcdb
SHA1a10e907a1065f43e7a04db69a0f82dadb157520e
SHA2566e015acd6190cce541caa2ef6a610a411f2511468c71ba1f637559043414d657
SHA51202f716e5c48e172671187b99e4199613ca39345ec81ec0e9f99accfa2bc0c92bdb5fe60bdd57f77b9e4ba72e964316f585b23232094c11eadd900144b1002fbe