Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
29/05/2024, 23:55
240529-3yt9kseg2v 629/05/2024, 23:46
240529-3ss5bsee4t 628/05/2024, 16:22
240528-tt9n2acg26 4Analysis
-
max time kernel
112s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 23:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fbi.bet/
Resource
win10v2004-20240426-en
General
-
Target
https://fbi.bet/
Malware Config
Signatures
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 63 wtfismyip.com 35 wtfismyip.com 36 wtfismyip.com 62 wtfismyip.com -
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2796 msedge.exe 2796 msedge.exe 3308 msedge.exe 3308 msedge.exe 2248 identity_helper.exe 2248 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 836 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 836 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1872 3308 msedge.exe 82 PID 3308 wrote to memory of 1872 3308 msedge.exe 82 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 1820 3308 msedge.exe 83 PID 3308 wrote to memory of 2796 3308 msedge.exe 84 PID 3308 wrote to memory of 2796 3308 msedge.exe 84 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85 PID 3308 wrote to memory of 1308 3308 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fbi.bet/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e47182⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4960 /prefetch:82⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10897265901190697077,15191153264717093068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:3084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x340 0x3f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
1024KB
MD5214b2fa780663e5b1778c56a8c0c63fd
SHA12a82b012c67b9f595eb9d236514bdc5fd69f99e1
SHA256916ba93a76b04c7ba7dd845ba5df93b495016834581ea315af3b99207251cf47
SHA5126d1b74be3c6db291094fd464f4a6e9495e5d88eae0ab98cd94c27c2d201cc002c5dbac312157693ffb97504b14b1137f6faece68e5bce762a215d58466555ec7
-
Filesize
1024KB
MD5402d7adcbe25b295ff68fb576d0ad4eb
SHA18e00b991380bf45c1156556d1c5d93dcfce4af81
SHA25626311b158651431c9cc7d30811404efda784a6384b53443a58d58ef939cd6085
SHA512f83055433de3dbb6df61382f0e4445a007477a46ac975c757018f74a07fc0d6fb6a493d5799ad3cf774207a4d744abc042f23934f2e883dc3306d8495a2214f8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD590ba782834615fd2d99574622ed6a1a6
SHA1cf12ef3e1e7b0e594c4932ac3e1eef78ee8e3942
SHA2562eb0d39f3b9e8c5097898e37a874e6e6f62f9465985c87cac1e1b3c84343e103
SHA5124b2211289eeb4f02a94e25caa2cabdd270c236126245b8c31074477ed30db45e90e12f6c5d6237385fc7826ad167233efc49ff9abc1d0aaa7aa25c14dedf1125
-
Filesize
397B
MD5e1f70d698000be9d8fc63b037eae9715
SHA147b8cbe1853b3b1443aaa70ba8e28541030d9397
SHA25622f3e970d854e2a95c1d6f40cae01f2733591d44354fe980263908ff16ee19dc
SHA51221c524c4773ac938d2c7207e201a466817dbf90fde379b5d2d79a005ab1ce73a857746e0b6922a98d2dc252473d2565f38014c7c9566b9a849091e3e6f88aa52
-
Filesize
5KB
MD5875874287efb2523b65d054fdbb8ab97
SHA1e0e98d0600f9750cf093c1633bc0421a740b2cee
SHA256fcab16339f91125c2a692a2102ff8fbd2c147be02c9737514d39dc45445cb899
SHA51208442b157ea498f47cd86b8a8465cb78cb52ebab6e36927f684d63dd8e269e05e328d880a116ba81856662c1cc3181f1a93ab8544f7c84aae7dd1bd29fcb3523
-
Filesize
6KB
MD5e78cb7e07dd173bc12cdb99610bf8be4
SHA138cedc290f2d7c98ba3fa2a1270c666b6b606ac6
SHA2562831df9d9597456558c1fc870ce6d03959982c8aaf05d146989e6785e9fdcb41
SHA51243757afb42f0abb71c78ddcaa6d890da3dd33b9e96e45a285326ea500b93e388c53fe575ca3c6e8fc3dd9e04654752ee7c88f858d298e2e785d25401c013f666
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5fb4adb5ea7f7a058758d430155415eb0
SHA1858865d86dc5422e5a6507f933182a26cea3aa58
SHA2568723ed25f7597afa51622d84cb84a60630ccf45ee9043286eab78e1f92760faa
SHA512fba0cc0f2f5133e15554d87dedbdf38367dc964d0e2ca5be021be3f0613fbdbda5f1f20e9ec66e96bbc45c43f905b088ade7f5701b194c7661eee9730872a6d6