Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 10:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://url.uk.m.mimecastprotect.com/s/yVTwCRoARF0QMXDU9hFZf?domain=mediafire.com
Resource
win10v2004-20240412-en
General
-
Target
https://url.uk.m.mimecastprotect.com/s/yVTwCRoARF0QMXDU9hFZf?domain=mediafire.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 1844 identity_helper.exe 1844 identity_helper.exe 1172 msedge.exe 1172 msedge.exe 1172 msedge.exe 1172 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe 2760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 3396 2760 msedge.exe 86 PID 2760 wrote to memory of 3396 2760 msedge.exe 86 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 1948 2760 msedge.exe 88 PID 2760 wrote to memory of 2052 2760 msedge.exe 89 PID 2760 wrote to memory of 2052 2760 msedge.exe 89 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90 PID 2760 wrote to memory of 3428 2760 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.uk.m.mimecastprotect.com/s/yVTwCRoARF0QMXDU9hFZf?domain=mediafire.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9841446f8,0x7ff984144708,0x7ff9841447182⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:82⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15219982442783748857,3676671346578165521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58c91c8582b0c918416d14bd7eedd686e
SHA1b2ff8149bc21144fdcec64111afda492965c6621
SHA2561e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
SHA512a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
-
Filesize
152B
MD52579d07b98bbefadc929d80fb3dbd32a
SHA11ceb57c4b81f0f23500e118a4b9a225116a467de
SHA256b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
SHA51253522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5cd14fd451de704329932f6ff68aafccc
SHA184d90f7e4824f82c5db4104e621bb07718f17eab
SHA256adba2cf2182a2bfaf176cf59f48c767ce427b110e2517523bb42861907ace682
SHA5124722b4a358211747d4c6b589e82163d02768c9815572fa7faf52dd1de4203fd2cc8a952b1f91efa7963562f20dd5245dfd932f4e6e2b7471574daf2d90ae1a39
-
Filesize
6KB
MD5a15ab672b6a4e3422d84a3c81de888a2
SHA162c8f23524037894b71d74289302233777d79827
SHA2562dbf25ea57ecf7a005b2e5bedf2305cda94baccbc591c407f6e4c36e9c368efa
SHA512333783637502d4d4028d078b96da36609f53d4f860157a62716e126d436a3d8659d892740d7a8130ebaa26a488f0d91ebe1e8845396ef7ebdea4552628d91be3
-
Filesize
6KB
MD5fa53e486bfc2adb9e9236b895f51c2f6
SHA1bcec506b0b0499034e4d13f146daf82346cb886a
SHA25625013b8bd02a5fe8cd1d9224bd0263dda6ec311e74314f65b4f1e7abe9853e6b
SHA512704ce2b1172995e19d524a8f92019c10118c9ca8779b48d9ce2f1e27bab03d6971c17e18c552a4f3f5064c49b635cc4cfdbbaac3953810e516c46a28bc88f317
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5cf402e0fb1eb4d588f8af8c13c7587e0
SHA13666395023aa2a0a112db2b53c1153a73d3902ad
SHA256ade595c4b5f3918111769f7e6d48e205f4374a4fb8612276e0910f12850632e6
SHA5121114e0e007850cb9895143012481fd93919092b938d38585c05841c62e65c75c87bc29e96d53ec95e97bb27c1c3e644f56f71086f629bba5699456b93eda763d