Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 09:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t5.emails.virginatlantic.com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=Hofwonen.btuijkoi.com/aHVnby5iYWFuQGhvZndvbmVuLm5s
Resource
win10v2004-20240412-en
General
-
Target
https://t5.emails.virginatlantic.com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=Hofwonen.btuijkoi.com/aHVnby5iYWFuQGhvZndvbmVuLm5s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1076 msedge.exe 1076 msedge.exe 4320 msedge.exe 4320 msedge.exe 1704 identity_helper.exe 1704 identity_helper.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4564 4320 msedge.exe 85 PID 4320 wrote to memory of 4564 4320 msedge.exe 85 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 3428 4320 msedge.exe 87 PID 4320 wrote to memory of 1076 4320 msedge.exe 88 PID 4320 wrote to memory of 1076 4320 msedge.exe 88 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89 PID 4320 wrote to memory of 4572 4320 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t5.emails.virginatlantic.com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=Hofwonen.btuijkoi.com/aHVnby5iYWFuQGhvZndvbmVuLm5s1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1d2446f8,0x7ffd1d244708,0x7ffd1d2447182⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:12⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:82⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12047433465851359120,17163457765469985284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3424
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
Filesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89cd3822-5427-426d-b541-a96aaf26ed3c.tmp
Filesize6KB
MD576e270775a6b0da92230146c70eb4802
SHA150554989fefb00880e443ce84bf6edcef002a102
SHA256e4a678d5a7774c38dd09e49c813acdb15ce9b93fc7e3b4898bd96c7186e0676d
SHA5120249f4dbee596541bd317e1664e6d3838ece81efa622e2470a20713a97f02138c792db08325319b49e1092b41ccded69154e6a8f8bb31cc5c59a606398ae4cfc
-
Filesize
196B
MD5550e61519762675475cd5607182e5754
SHA127a14e8da302e83ed158ca983f9e7d80e790088a
SHA25698d56b9422e72153c917523139101b7d330d6b82f74b191659ce71585e72a5cc
SHA5129b15a6abcdbde0e4113d596349a890a64ae762eb4b2f87f35abd0c2ca7027827a54851fbc5cd29e52e226fe5ab2cc9fba5270a864d73c95ffe8e38ab18046058
-
Filesize
6KB
MD56a3325f6f4b0d1090862962995f17c7c
SHA1bf7eb59a53df154d31f85ac2e958de2309c361a3
SHA2562aacce42c0595f4d18bcd5a95c3be8fc369cdc7e5a8129b75318868c297a54fc
SHA5124e3cf493084aedc760814c3847dc87ced8c395352622ed5f83f5ddba69d5c392aff25059c23646369a4a90e6e42de82bc8604edd41604a01e259992d152c90d3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD52bc2125664aff7a484da6f7e6ec86359
SHA1b571c93ee1a4e903ffadd61363fa42604b18c1ae
SHA256379d3d16722280930b32eff53c813eb54aa33fdbb10927d21b6e48acc8e5a1bb
SHA512b46fb2175cf54b28cb55148045a8f5645c139e2b208e60eb1322ac82f294965ca4d451134931325b0264a048651381c22489a8cec85952a80a4ed7a29bc407d9