Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 10:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://str-v.org/t/en/partie.php?94e970083
Resource
win10v2004-20240426-en
General
-
Target
https://str-v.org/t/en/partie.php?94e970083
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1912 msedge.exe 1912 msedge.exe 4580 msedge.exe 4580 msedge.exe 1604 identity_helper.exe 1604 identity_helper.exe 2132 msedge.exe 2132 msedge.exe 2132 msedge.exe 2132 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4348 4580 msedge.exe 81 PID 4580 wrote to memory of 4348 4580 msedge.exe 81 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1920 4580 msedge.exe 82 PID 4580 wrote to memory of 1912 4580 msedge.exe 83 PID 4580 wrote to memory of 1912 4580 msedge.exe 83 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84 PID 4580 wrote to memory of 1852 4580 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://str-v.org/t/en/partie.php?94e9700831⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee9a746f8,0x7ffee9a74708,0x7ffee9a747182⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11615056404597508020,9784421733551455792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5519211dabb09f21f8b0ed257d414d347
SHA15f209ff311af52302fdbe2e0498f9b6e09380454
SHA25618f5ec9ef33ffe9a0a248bb8478073b60000fd0cff54e816da06b6e94dfa3659
SHA5125874d4ccb184b9c4dcec054bf0152a7228f8f4e9ad0110b63e164d0a326607aa970e3505688ab3b2ec057ec2d179277f5c5b7cc72fa5b6680235d4b7143d6655
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5c2b3684c56434a577dc8fe188e1804d9
SHA19496162f5e3b32fc4ab52cf91c1c98190712704e
SHA256b46dd25db77589f6eb2e6e156bcd3c9dabec7432dcc7ad2311941068c189d42a
SHA512aab28114c23c351d65d8482ded7f4e7cc03a27157bcc48d19c462a571b67d455bd4d7f6fd9ed118c4fdd2c62e221ff4e3cc9830e539dc754469b11260c216a3e
-
Filesize
177B
MD59ee23e21d0b673a7ca964626bf3a6094
SHA10bc98a6a8b9603f64cf6a505def868dd5fd94e2d
SHA2563cc8ceb2323f4aec6f2cabe6fd3f0c859e147b89adf174aeb2fb619b060f464c
SHA5129fec451b292146c971d6463bd97f9598cf839f6ce107f2814de549185404a1df8374e98adee495750031c5f4a7ff6c32ea03704727d72bf5de53645b36df0579
-
Filesize
5KB
MD589e56b591e882fcaa7fa6c87e49cfb8f
SHA12624d48796181941b745620a64d8611d86fce59c
SHA256d0549e53d363c08995e27a1782e0f1ac43d673b56f5a714b1cbca78b441fdcd6
SHA512eea5c451bd0c7991a6ca20bf5eb0a1bfcb904a153ea01193d6ed80773f85bbb7ccac3be436abca2cbeb0aab6693803052bbce72799c045fb267aee7e1d77807e
-
Filesize
6KB
MD594e17ac4ba87b0c28e37ac09202c0885
SHA15388f0a755e70eac33f9d35206a88fa3d1641c8a
SHA256b584ba640f946743395c2469bcec5a58046a1c84365af9928b9b6b8e648bca41
SHA5121aa4c1eb612eb33ea0fa247d2d40943b5ce00d4509f833e18e80f14bca6c6280728d24d496c0b934558bd40cd145003c809c7de44b6815392836f090fa177174
-
Filesize
6KB
MD5e4b31cf53805f6616aa8daac8978771a
SHA18e93b2567fc5c55d011ab2217279c51e15194ce6
SHA256758d3aa26a8624963089c0e784833a8f73f7199f750c4979c7e01633c257580e
SHA512ccfff904c5d2a09a314ab57c78ae9b0d334a6c2142eac10d251b54ad8fbaf8d0c0d1882f41a73af7ed6c50197accec4a89119fb5e0ae40a66afd97615f0aeb84
-
Filesize
6KB
MD55f3abde646303f504dc0f1faabc193c4
SHA1e9bf42a3e57d27a9044d8c1284e420826ef0591e
SHA2569fda33fb5d201de977ae0b41d439e5e8f6531ebcbc7ccb28722b67de09a19a2e
SHA5125509e613e3c94e8f46b4c1ad361d6e0c492afae1a2bea7981a9c7140b8a62bf0c45f57a6b782da248e5ef270772a93a30b6bc2e19367f9be62d1f5130bcea911
-
Filesize
6KB
MD5d78249eb61a450b9d1584422789ab10c
SHA1e0ddd15a0316ee175f8675c42b60ddb20db81a6a
SHA2568348d2253adb0b0708528712d4dd44e0ad0c046a1db3e4aeda3f06cd28629794
SHA5126e333d7795732256336241db81b9aadedf5a263107984a26e8868eb04d16933926b15183b0841a45ef09360732c1f6afa027257c8e9c431edadb5447f170df49
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84