Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 11:48
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/gdaxndntd2354qx/Crunchyroll%20Premium%20v3.56.2%20(Mod)%[email protected]/file
Resource
win10v2004-20240419-en
General
-
Target
https://www.mediafire.com/file/gdaxndntd2354qx/Crunchyroll%20Premium%20v3.56.2%20(Mod)%[email protected]/file
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2816 msedge.exe 2816 msedge.exe 3084 msedge.exe 3084 msedge.exe 532 identity_helper.exe 532 identity_helper.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3236 3084 msedge.exe 83 PID 3084 wrote to memory of 3236 3084 msedge.exe 83 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 920 3084 msedge.exe 86 PID 3084 wrote to memory of 2816 3084 msedge.exe 87 PID 3084 wrote to memory of 2816 3084 msedge.exe 87 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88 PID 3084 wrote to memory of 3104 3084 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/gdaxndntd2354qx/Crunchyroll%20Premium%20v3.56.2%20(Mod)%[email protected]/file1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90c6e46f8,0x7ff90c6e4708,0x7ff90c6e47182⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:82⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:12⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:5252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:12⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3898165479017996881,1033597267117450033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD56e76f999277be638a3f45194b9372b24
SHA11e719755c3e231ed98e8829d608d86480f6e7afd
SHA256204ad5cc447b49c5e9e849226a9a92e695c074da1c612e47becf2f82eeef1c13
SHA5121e30d7dbbb6ce7acc4534f8549d6cd99649492a90ffc7cdb510df351f6dc8ca30e3486c0a0cc9fb17a7a2439f0fc98ad634dbf1eab84ec30e4354b789b7168ee
-
Filesize
5KB
MD5eac76e98ed147b054a8073c36fabd33b
SHA1868180025833067a0e101ccb34a48e2aaf1a9757
SHA256530002d52712c8953c2fdd95e623afb617a4a266a0d2b4dc09596d38dc029b9c
SHA512334606ef6f6601e5f893752ef4b59f265cf2e40e4f812f4168579ea1721d3095051d5e4cd3625f46059613d3524222b0d92754a58bc7f01735f9293845a2fb52
-
Filesize
5KB
MD59ddd8231c0f4ba01f89d1005b02a3e18
SHA17a76fcaa9b522a25261f40036e1567959512fd0a
SHA25606431fc7f980bce977ef2569ce61b6b45a6f951fabb576b1eff0c0267a16eefd
SHA512cb335d908fdf0c8057ad66adc81d6358640e33dab0cc683a53cf933bd0f3b5df8089ea5fc91029fe6f61039ee505dc8ba41313f422c6508dff3237421d50dd30
-
Filesize
9KB
MD5ebe7928894a326584292215b3fdf2d04
SHA188ab50ec587346cdefa877de98ae1156f4f98544
SHA256c73fee76766a1650790bbba75121615a99505fdaf9073e2f0b6c8ced6ea449d6
SHA5127ccf6051449b0f84b17d6ce666e88e21ccdf0221d5548ff8243e4fd7abe87f973e96c4f47595c3b7030598adb97d2a1a380902b81248b1b66843cc1edee31019
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c4c1da15c8bb3807cb5ab297e699b431
SHA131059bff30ed10e2f35830a961cb07194aa01b2d
SHA2568524b4642048f4e3ada5426c015277bf2510daedd322d1d54ae18dc572ba4d47
SHA512734d1efe248f2ec249eb9a3bb5d547e9aae31b18bd1c98fc627f09b873bdb16b348aa3881cebf41da036ea8d7053125acd397ddbe6523e946358b13f7519d4a9