Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 07:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://url.us.m.mimecastprotect.com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense.proofpoint.com
Resource
win10v2004-20240419-en
General
-
Target
https://url.us.m.mimecastprotect.com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense.proofpoint.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2176 msedge.exe 2176 msedge.exe 440 msedge.exe 440 msedge.exe 2396 identity_helper.exe 2396 identity_helper.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 468 440 msedge.exe 84 PID 440 wrote to memory of 468 440 msedge.exe 84 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 4088 440 msedge.exe 85 PID 440 wrote to memory of 2176 440 msedge.exe 86 PID 440 wrote to memory of 2176 440 msedge.exe 86 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87 PID 440 wrote to memory of 4972 440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.us.m.mimecastprotect.com/s/17YMCXDA4jsPyAwJs6MDCV?domain=urldefense.proofpoint.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe43a46f8,0x7fffe43a4708,0x7fffe43a47182⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:82⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13198590278166298916,17089189685049410894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD572f009488bb955d6bada13d4bc617f36
SHA1310e38bed757f3f912e4b998d419f49a65a8a281
SHA2566eedac3a2257e55b628a50f51a8653d73ac7e22b69f068176d2eec4e9774651e
SHA512028fb7ff5b58415d046d77f807416f25ee46145651c3be9c3f073b23ab2f416b96e4ae38534f98b47e24f43aa22d0a1958b94dc579e5091a6f5e680ada3f4b69
-
Filesize
1KB
MD5ef882f4ddbcf719d839aa8ffc9c17f7d
SHA1622b39630d31e9954b82102cdd1f13c97c5fb6ba
SHA256fba312d61d018dc0d65b052847c62b986a7c3d9b68db3f0f423e2a8013f8a053
SHA512a9ab05acca293918f38bd7cda27355a5d6a36c1788f72c3dadb9c7b84b0aa816ae1c36a331774b9a23203654c71b88aef20cd4bfbf7408a8b321d842ba5f1513
-
Filesize
5KB
MD51190443421f38e083b0abb48fada6ca4
SHA1438a11845d055cb126df389992788c23b0193cd5
SHA256e7c0ee6716a744c7deb0ca891de7eac162e0f44ab568e879b324a4790efca19f
SHA512cbbe235572a861640f59d5e0c2e81596159bfe2eefc5ecef1e704d0b9afb2da5018887cee1c6ab844136915e1468d68616588e4c13e88be1724d567e7f64571c
-
Filesize
6KB
MD5967219013ea9571dca7e9e3d1cdc4f7f
SHA124df8f51905cb3ffe19e1a1699949019814d5732
SHA2565760ff60554b0f2b317d18be1eca4815862f2612ebdc8ca0e73244519313281d
SHA512dcb8fd2efe9aa9763639e9cdb8cc7ffb67804f9ba90a6c3d87c725b01b2609f2673b99003e5400d01d37e1592992308a4de93f7444928c850265df31fd5f005d
-
Filesize
1KB
MD5e95e1fbee3e546afdec2c6e596919419
SHA1026c81cfc03a8732bce851a4501df4e391b5a336
SHA256c84bc890a3cf29b8840a62252c98661d496068f636e09c4e68f96c26cc623da6
SHA5122a1045192ca4d1e947c369b34ce2a72db19387541c34d2edfa507a79340e41dc20350614fa40f3128a5b2103343448a1807ed378096a0f755cdba36384b784df
-
Filesize
1KB
MD5068f82c109320de1da43ee5bec47b346
SHA13691a05b837766d5b807d18890d71bed8bd3738c
SHA256a848b81b9f966870dc18be56b8d7844267e40ae9f4b515cf9ccc642ce59e956c
SHA5124807cd5b4146b981e5e728ead1574dc9de3540cfd4da126ba3d4fb1effa278f2310e0081b3be0f44d3438563795f773a2d5f3c23110f340d8ac5ca58486bfe2b
-
Filesize
1KB
MD505d1c2a1de5a766ffc933644da41280f
SHA11476ce38d261c5ec8d26363c5ce741f67b014c3e
SHA256c69d42373867ab2c53ec243fc5fed200751d82fc70206cbc2fb04676202172f2
SHA512a4be8fe4e17c5fc9cb1a4773d8a447c6573946f00c2043a4f8b78f5e56850a4869baec28cd7518b643f8382bf7bec21d803da0658267f6ce3f4574816e66b3a1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f437d313-9077-4e17-a0aa-aea017e194db.tmp
Filesize6KB
MD5745bb06b8049948e67175d3c93b23aeb
SHA11a085c2b643fca8729f0829aa488d6559a071cc8
SHA256f594bfd834c732b2a6465ae8163a5b03af76913888922dd7170a92704db9b22b
SHA51240358be4baab3aa19302793a3f3567443ce4b47f7ada3520f7f02fd8a72f6b84b35cdd40dc81ac67f4396b75998c4736aa4f67e63266b76ea9784f5d62c14234
-
Filesize
11KB
MD5596cd4cafef8cee9519e3c85fe2655ba
SHA1bb976ecfa3f453f1fe2ca190bde4b50755cbc0dc
SHA25659435be1765c30446f6d703f07b42ec3739577e2cc9da518ba4c2bce04ca2408
SHA5128342ce24be00f38e3dd8ae0c7ae2949cf8a21a14d8c894ad5394b0c25bde9a220b701d2d701db7d5706614e16c4e5c777e5e3bf62d4391fb70419d77756d5b65