Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
480s -
max time network
485s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 15:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://saskmade.net/author/admin/
Resource
win10v2004-20240226-en
General
-
Target
https://saskmade.net/author/admin/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 4520 msedge.exe 4520 msedge.exe 4252 identity_helper.exe 4252 identity_helper.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4520 wrote to memory of 1100 4520 msedge.exe 85 PID 4520 wrote to memory of 1100 4520 msedge.exe 85 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3084 4520 msedge.exe 86 PID 4520 wrote to memory of 3640 4520 msedge.exe 87 PID 4520 wrote to memory of 3640 4520 msedge.exe 87 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88 PID 4520 wrote to memory of 4788 4520 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://saskmade.net/author/admin/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8831b46f8,0x7ff8831b4708,0x7ff8831b47182⤵PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18245227358296566515,7539310982556653986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5982992e3194ba99856b3ec94db06ac8d
SHA136b757d28063e92948aeae39688e39109f5eeddf
SHA256f1162cbd811cdb8ec6dd19137c5498cf88554248adcb0cf48413be3f6894e304
SHA512fd76a2ec23630ee6ef329302b451c2dd53859058639598395e2907c261da1934eb573453d3316a165cc5c63dd9bb45cd7193fdc53d3b5afbb66b94c2c0e5d6a8
-
Filesize
575B
MD5d6ae08c22aeabf2a7143e0a8c1568ca7
SHA1c8234d68e19a07b1012910cdff69ec10f87be89e
SHA256fdc4a8058fbf1fa195a7a9baf2758e9826b5d1ea39180c19779792e83e3403a3
SHA51278f76f6e218b552f350e6d88d2774066d86acf8ab56f80d9af68e4dda02137abe2293c3e0e12b032bc8587968bb1bfbc2ac19b04b9784c4b1b589651da7351f2
-
Filesize
6KB
MD54098a32fcaa32ead3dbd6ab944be39fb
SHA11bed09a48ba3580f4cb8a4b29c0505110aa3aaa4
SHA2567f85532b18091cb69b620fd50786dfd6bb85e609a717716d3a77623f4464ed43
SHA512920204bf4a0f645f1e46bf7cf8596b86f53c1fc7f71ec9177bc38ca1f8c9029b4847c45d21ec355cd426eaf8cb703ffe14192be2cdf5143bf7d64a90b9944abf
-
Filesize
6KB
MD56d49b942516e08e4a4685839e8461f3e
SHA1df4dc7e3a543bf2fdfec80acdff51d1f19c87100
SHA256276f27a3b5f914eb29901a5de97ecb762333567466dd4d85fc4d9c3a4427ab9b
SHA5123a2a24d2af64ae1eb048d9dd36ca17939cbe54a61943347e87ee9c402754fb3057653bb0ba96f74ab3740c42d551f0eeb19a3aa60dd5dde09ab48bbe541fe0d8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5df456112a4a77545699969ad12d14678
SHA1b88481e3c6da8cd57432c2b153518f2c7d0463f8
SHA256bfda5ff99ff4e76bd4c0bbd61a05e5ac4b4ae04675d192453894bfecddbd0b5f
SHA5127c4a395f00d65aef98fc4b9ad0166fd312734f283779450d513caf0d272a49e8c999464fceaf661334f37a26a1464b1a9171bb9de60eda8eebf0937f24a3b115