Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 18:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
Resource
win10v2004-20240426-en
General
-
Target
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 548 msedge.exe 548 msedge.exe 536 msedge.exe 536 msedge.exe 4840 identity_helper.exe 4840 identity_helper.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 1920 536 msedge.exe 85 PID 536 wrote to memory of 1920 536 msedge.exe 85 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 1808 536 msedge.exe 87 PID 536 wrote to memory of 548 536 msedge.exe 88 PID 536 wrote to memory of 548 536 msedge.exe 88 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89 PID 536 wrote to memory of 2228 536 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d7e46f8,0x7ffd6d7e4708,0x7ffd6d7e47182⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:836
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize840B
MD5bc489e44b03466a33634a88948903a56
SHA17133a96f21932894194cde2a3ef8bb65ae624091
SHA256777b0e5ffa3e07f1465982a4b1443f92053192dc436ae7e60421fe2478bd0c75
SHA512e556f518a3aa677c472e6ccab3654218ba4e1674450ccf4ce9dde058e7ba9cbb20ccbe6e6ee3e718c081f1e3f6cd4cbd25884a3c03937b084ae32165c6017ca8
-
Filesize
1KB
MD5b86b5001fee6fcd11df637661581ec7f
SHA1bccaab1fb9efac70be4ad99b8e33fc261629d755
SHA25602aec9123d778186e0d058877801c4fa2084d0b75eea4a890b2d37e875b85130
SHA51236a2d565c1b05599d48da10e05a0862281714967d69de91746664ddef85dcbb2069362a9879c115c2728d915416491b9f23ab0f1b1a8e5fc3191fcdba29824cc
-
Filesize
6KB
MD5638d5ece2eeb25aaf60af17512b1f3e0
SHA1cdd84e5cbe805630d8f443411c15c437116a6931
SHA256decb32d24e4e3802fd928745887a155173339fea65793505f25f9358152744d6
SHA51289a15e16744d5db62d1f3c18da434d08a7e4454de79f5f0663767fc99b4edb517392ecc48bbf7e93e64110b3c30dd2c0113638845b0e438d009013b5833182d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c123a6e8-eee8-487c-ba8c-a9d90d4e35b2.tmp
Filesize7KB
MD5d2022d4002fe8fd2091b62f5a25c4a0d
SHA1cea59847f5861d7ed613645907e7521ba365545a
SHA256753dbc7f20e4a3921c1641bab0d6521ffde6ef1a116af58efe2fce4020c73fb7
SHA51210d682fe5f744e8a798a0584f3788cb4daeb8f3fdcf87b1a6804ff22361fe963130d5a518d913059f72285c6b3790eba897fd44f5ce0cc0a67f105e8df2dd62b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD593a0b026d9f3b3c5d2cb46a00bb1854b
SHA1d748b4b871842ad2392bd58ffd26e6016920f718
SHA256ba2a55781e269c0402f2d64c119ba585352240032895c48cc70486faa2044e1a
SHA512b117ac3c9f7642abd329e20961d236797af09a1ca2d3dda504f402e8a7d46004b5f5f3f3f65214cb7bb808531ef537d72eff00ac701f69604245d62c1b2c602e