Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/05/2024, 00:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u.to/ZwKuIA
Resource
win11-20240426-en
General
-
Target
https://u.to/ZwKuIA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 560 msedge.exe 560 msedge.exe 3876 msedge.exe 3876 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 1904 3876 msedge.exe 77 PID 3876 wrote to memory of 1904 3876 msedge.exe 77 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 2176 3876 msedge.exe 78 PID 3876 wrote to memory of 560 3876 msedge.exe 79 PID 3876 wrote to memory of 560 3876 msedge.exe 79 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80 PID 3876 wrote to memory of 996 3876 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u.to/ZwKuIA1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98bd13cb8,0x7ff98bd13cc8,0x7ff98bd13cd82⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:12⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:82⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10278117803482928381,629157083748067954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5956 /prefetch:22⤵PID:2952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5de47c3995ae35661b0c60c1f1d30f0ab
SHA16634569b803dc681dc068de3a3794053fa68c0ca
SHA2564d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7
SHA512852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb
-
Filesize
152B
MD5704d4cabea796e63d81497ab24b05379
SHA1b4d01216a6985559bd4b6d193ed1ec0f93b15ff8
SHA2563db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26
SHA5120f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41a77608-9a96-4f54-a739-0306b7145701.tmp
Filesize5KB
MD5dfd06ece18c6b94ac3638dba25340d90
SHA1c3df122bd719ef96749db90ebcce92f524d80a65
SHA2562b727c12401ee7a643607198693fc472792dbd4cb0689fb5395be4e21aa5c211
SHA51296ca56f1cea638dab49e265f746a0bf1846ace32054ae7df895531d21e9bdf674f85709fcc6aa9a4fcb0180dba0bde426271a3b38839b53eb7d17d6d3fc9d38f
-
Filesize
5KB
MD5eb8205c9d0e907e00af991ffed65c984
SHA1282a824d2d58f48622e0b845ebb8f82ac71ebfde
SHA256f4c9af3b467f2bad8664c483105d63706c7dc5eca5d5e8b0331d209c3cdf61bc
SHA512a21a6b7a78c8ba7b6d9286fd7273b9d697bcf2ee312ca3cb6b3fb88ae8b2224c15a700711754aa9660890e09b2ad72b5db927b8902729e498baba75ab4e4ae72
-
Filesize
6KB
MD5ce04e34692066bf88143b9cf9f127616
SHA1edf78e8797919669105e17b5e6bf9484c1add60a
SHA256198e17c145a43c3ee40ef0ad2dc5fba4fbd4f2e5bdecd19a6007f5f179cd9ba6
SHA51292a5a20992fde690815f37f91875ff7da9eae50951d7f2b6183012e7202c085324e354fa19d2ba983c7068a0e3beaff814c53352a9b3b391ea98f4a2feedaf41
-
Filesize
6KB
MD550cb1626625f0087ae3874e2b18bb566
SHA181a580618a87bf2c2afa312e7cd23fc22a7cfff6
SHA256c7dbe6407b43204ac6ddd40d8dacbfa4209f44494aae6625c51cbbd222eaee35
SHA512cc08362d5b21348e32b4f342aa049d7f783fc46873a2e132c362612850686b373cc988bc8456b9acd7cdc6daf209f194e8526eb462fe57370ca4d56ca181e775
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5d61a86e196ea0f6c7af515eddc63c0a2
SHA1c785f5f0482976df0e60aa84d803b95cf89622c6
SHA256515692aaa3a09ab2f1e86209a410610eb421da4687b2e9acceb48a815967ce84
SHA5122e8620cae9e858cc0158bd369cf30cf37c90021dd37b2406383cbc5ffc796351721f5d3ef3f691d3f483afeac76f4d4282d03be9fb5d4c55d732e05757504fe7
-
Filesize
11KB
MD5ba929d81873f9c767a37a8c460e5a284
SHA191c614eb84dc40a6dc2d5555b7e5d7cc35b5f244
SHA2560d73dd7b75bf8ab5b2ba96771155b3c1b72495d888fb809f48641661c36fb0ab
SHA5128ba0b1e5f8698ce599819be6225a4189f99b6028d6a8724600c251dad9cd17fa0e0f6d77b90aff52527ceeb7c8c9111ce2b18bc6dfaccb1873812b693b16de47