Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/04/2024, 14:30
240428-rvjg5aab4x 1Analysis
-
max time kernel
126s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 14:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/s/mqoAua
Resource
win10v2004-20240419-en
General
-
Target
https://gofile.io/s/mqoAua
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3552 msedge.exe 3552 msedge.exe 348 msedge.exe 348 msedge.exe 1272 identity_helper.exe 1272 identity_helper.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 2724 348 msedge.exe 83 PID 348 wrote to memory of 2724 348 msedge.exe 83 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3868 348 msedge.exe 84 PID 348 wrote to memory of 3552 348 msedge.exe 85 PID 348 wrote to memory of 3552 348 msedge.exe 85 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86 PID 348 wrote to memory of 1088 348 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/s/mqoAua1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf6b546f8,0x7ffaf6b54708,0x7ffaf6b547182⤵PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:1088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:12⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15710240369997722847,12488308364125944320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
6KB
MD5c129c257e8a1fea20925b8e429151604
SHA1a810e17bbd33db36a3ffcc5a30fdfe6415be1522
SHA256cbac16303762c07088081707e3613b0837e58e71fff2c3efe731f7fff17bed3d
SHA51270eeac33ab67e6f523046c95f8b86079276b78d59d689d3b56bb615c6df3702e7c911690fc658808088773d5cfbf37719b4949dd9664b52dd51092bba685021e
-
Filesize
6KB
MD5e7997e9551bd754200ccf464e5641b74
SHA1903c159bbaf3d7bf4e916528838ce1ac6d427f0c
SHA256391e58458a5b50d43fc99fe498984be5aa9304dca9ca478440eaadcba5b9be61
SHA5121c3d2c7bc5198f215142fc53fd3d5917699c5ba84541713d1476a85591c031f535e46f8faa77553a884cab65a1a1eca582dc0e22ef86538095f5920fb8bac69d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD52c6510765cc6bb7a3ff4e7e009317706
SHA1424ae0984a849ba480fbb5798fccd951a6b62e31
SHA2563950d19331d5d8d716c28280c14434711fba25278c8b525676a90ae3808d4a14
SHA51203d4a2317d56987fe74bdac9664a29768277c01ef770303db4f38cb40d6902f50808501ade5d4bf2c80328bc819952271bc528cee62184eeb53dbeb06cd5406a