Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 15:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://workupload.com/start/dEThUq6GWFE
Resource
win10v2004-20240426-en
General
-
Target
https://workupload.com/start/dEThUq6GWFE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 4764 msedge.exe 4764 msedge.exe 3872 identity_helper.exe 3872 identity_helper.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3972 4764 msedge.exe 81 PID 4764 wrote to memory of 3972 4764 msedge.exe 81 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 1916 4764 msedge.exe 82 PID 4764 wrote to memory of 2088 4764 msedge.exe 83 PID 4764 wrote to memory of 2088 4764 msedge.exe 83 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84 PID 4764 wrote to memory of 4536 4764 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/start/dEThUq6GWFE1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aba546f8,0x7ff9aba54708,0x7ff9aba547182⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4126467252575369774,4988784640644001244,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19f74bd9-0ab9-42d3-9b1f-b67e51ce1d09.tmp
Filesize1KB
MD5fa1cad058c0b4cbc4aba3bf375e1c2b8
SHA1f972395226faa45e2af441707cd17e31346a1a76
SHA2569b5919353a89d1ec0465317f961f13c26c0d8e11956932ba5242a74368f9ed25
SHA512ee86ef939034a1095883a7efd22245a891a1997918b12efaf777c70c9d4ba81645ca5613fae5ed9201bc932ecf5c5e8c46123c0c6b00db3d3b58b3e3b54c6de4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5122f02fbf89fd7d959dd00d0ff29115a
SHA1320993d4609147fc1ca8c54089d274c4745c225c
SHA256ad2bf34fc10da95f6861042374716abddbc94fdac0796c7ccbb070e62259f4df
SHA5129a31a2641ceb593e9cabcdbd87ad538a6b8dfa639781a0ba36366d04cc6cb6c349ef43e43164bed0db0b4a391446291ce697b077cd468afa800dc8754af3021d
-
Filesize
6KB
MD5d468aa233eec3a9e5c362e9eda4f6f06
SHA163093ef4c166e2db1f71d9c2b0f26ff101fdcedf
SHA256b0096bc048cd1ce3958af7c7523fb402f1b19bfd498df6bb0627bc4115c4e153
SHA512582a2a4310d9957ce7839cf5b543eb4039669742a1aded6bfa6351ee38739d13726c67725684cef06146f70f1f55c24dbd1ebb8c951c70346ac0b3cca69dfe89
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5e3333c-a187-4e42-bb15-3b4f5cb8a9bc.tmp
Filesize6KB
MD53a33acbab3bf3b86fc10a42c7f1fa480
SHA102e4bd25983555b6214dcb8b9fa9c1e6dde9498a
SHA256b695168e8288bb6c8928879723d8b3983e08c87333d26c78934d30ab0d71136c
SHA512464f52102f06b82560bfea32642b21f3524659848155dcbeefc6bfcaf7d3077323d5002e6470194b92f707b805f914b85c8c4bb019308a57496db58e76e42449
-
Filesize
11KB
MD5858a972f49aff706d82e24ee4dc9cda5
SHA16efd96d99ebd6b0e9abfc4406f12a463b10bd173
SHA256e96fa99e8233f1d844e8c72fb6c20b0b447f873c59575adfb1bf168d4c132564
SHA5125113dce1b1d8b954c13b3a34e86936a5475000269f5212e5105b2e8fbffc8b15856071e1e9f203525bb46052fdf882ca718d64d15f443fba2e38f012eb93fb88