Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 18:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://sia.soundestlink.com/ce/c/65ccd6aafe5afe8283331453/663328291cd33bde81da67e8/66332be730f7074d03255076
Resource
win10v2004-20240419-en
General
-
Target
http://sia.soundestlink.com/ce/c/65ccd6aafe5afe8283331453/663328291cd33bde81da67e8/66332be730f7074d03255076
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1612 msedge.exe 1612 msedge.exe 224 msedge.exe 224 msedge.exe 1864 identity_helper.exe 1864 identity_helper.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe 224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 3920 224 msedge.exe 85 PID 224 wrote to memory of 3920 224 msedge.exe 85 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 2972 224 msedge.exe 86 PID 224 wrote to memory of 1612 224 msedge.exe 87 PID 224 wrote to memory of 1612 224 msedge.exe 87 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88 PID 224 wrote to memory of 1648 224 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sia.soundestlink.com/ce/c/65ccd6aafe5afe8283331453/663328291cd33bde81da67e8/66332be730f7074d032550761⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf3c146f8,0x7ffdf3c14708,0x7ffdf3c147182⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12249303540457474298,5112985159371608487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5060
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
188B
MD56c00844c69ff420715bf189c8747dfef
SHA14f6d3857ea773dfb98945a78b4249380aeeaad59
SHA256bb55d65d08b179d6a8c1068b99fd732fd32a5952c42c10c1099b7767e33cd4d2
SHA5129ea5ab908ddde6bfb8a52f48066a25f5bd687adc3ee94488b2f3be84a8e3016287aa517b173538261f313313b07b71c40d1a07e795a2a67b833382dabf3cdc8f
-
Filesize
6KB
MD5c0ded3e105ccf760190a87d6a4ea919d
SHA145845d22a4d288a81692b107f0c213334f7eed13
SHA256fd0b1132f442be659cff6fdcdb5e77fc2b1b161ca397ddde4a582cebfeed608c
SHA512f4bc63115bf1962cd5f2458dd09d22cfa4a80876386330c99278c98f175173a423558ecdbf82556c7659e5e69262b19d3166eaf58cbbc349a8ad4e0713676838
-
Filesize
5KB
MD5b25ee4f6268bb71126aa3b962aaa2cb6
SHA1cacfa7bd8f02cc6ffad6cb5c6e0022cfc54ff423
SHA25686c502213d1aa9c7095bc03978a9f6e6610102579a1ae260467b7ad4297ca920
SHA5127219097a7b507958dad9aabf5db73da9f58033028b351494b2b833a55ece1f6985e96cd5488270514ea4849573e4cf8e54bcbb49d52662fd00d91bc2231bf948
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e1aabc25bf2b3a369190b859939adf44
SHA17aeb0d93b2d6c7169632c92aa24f8a6aaaff549d
SHA256dd4254787cf3a23acf7cc12bf325783b0e2e75277fe4c12f2410b8d941d47642
SHA512d696cf8d6aca6a0fce081479fa5845761f22058d78f7b4e2236e728219fa7e71aacead44744fd0bda947290742ec4bd867f88b6863cfd62e2da32623b70f4be8