Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
16/06/2024, 13:34
240616-qt7b5aveqd 816/06/2024, 13:33
240616-qtlqesvenc 116/06/2024, 13:30
240616-qrxpxavejg 816/06/2024, 13:27
240616-qqbfaavdlf 8Analysis
-
max time kernel
480s -
max time network
486s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/06/2024, 13:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sourceforge.net/projects/autokeyboardpresser/files/latest/download
Resource
win11-20240611-en
General
-
Target
https://sourceforge.net/projects/autokeyboardpresser/files/latest/download
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4200 msedge.exe 4200 msedge.exe 1428 msedge.exe 1428 msedge.exe 2168 msedge.exe 2168 msedge.exe 2908 identity_helper.exe 2908 identity_helper.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 2156 1428 msedge.exe 80 PID 1428 wrote to memory of 2156 1428 msedge.exe 80 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 556 1428 msedge.exe 81 PID 1428 wrote to memory of 4200 1428 msedge.exe 82 PID 1428 wrote to memory of 4200 1428 msedge.exe 82 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83 PID 1428 wrote to memory of 2408 1428 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/autokeyboardpresser/files/latest/download1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95b803cb8,0x7ff95b803cc8,0x7ff95b803cd82⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3088177941307370808,1577755594199201274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4856
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f717f56b5d8e2e057c440a5a81043662
SHA10ad6c9bbd28dab5c9664bad04db95fd50db36b3f
SHA2564286cd3f23251d0a607e47eccb5e0f4af8542d38b32879d2db2ab7f4e6031945
SHA51261e263935d51028ec0aab51b938b880945a950cec9635a0dafddf795658ea0a2dfcf9cfc0cab5459b659bb7204347b047a5c6b924fabea44ce389b1cbb9867d6
-
Filesize
152B
MD5196eaa9f7a574c29bd419f9d8c2d9349
SHA119982d15d1e2688903b0a3e53a8517ab537b68ed
SHA256df1e96677bcfffe5044826aa14a11e85ef2ebb014ee9e890e723a14dc5f31412
SHA512e066d74da36a459c19db30e68b703ec9f92019f2d5f24fd476a5fd3653c0b453871e2c08cdc47f2b4d4c4be19ff99e6ef3956d93b2d7d0a69645577d44125ac7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD55524d10baaf46200b959092df4c77698
SHA1f8e0bf896d7ce82c760226a358fa2031f233854b
SHA256301304da5c67457732a7551b83ac1b40a5865c3d0b95ba1dcdd3088f8738cc68
SHA512a10e503f9c7129aa3605951333d6f9cab9ce89b5330ba1a7655a71b6aed875de46681b89dc47268f1463bf0d575f804438d3484d3a578c1012cee9e089bfbacc
-
Filesize
401B
MD572472bd29a48c3fd6baaf3032e644bcd
SHA18d8d3427429ccf65ad23e79811ff6ed602faaa36
SHA2563854b804facc975b88d8798524c29c027642d5be8897ace2dd1ee3a562844be0
SHA51230d947ced40d3cec67614adfbe047b1208b577eb234d26459368ca41af55625ddc6f9fd492b5c76409b4a2a46a5d4faa20ff1814e803b9bf0d4c4e71dad72dc7
-
Filesize
5KB
MD5f6139cd0661edf7f2894c52b267b2669
SHA13f34dc3cd66d0c18e34aa632db1006c71a0b7572
SHA256716c64d59791222b2ad4c8248f37d6079fd9261fbd48e3832bfd0bf91b8c79fe
SHA5123bdd3dd0cfba8f908f3fee93969dd1f9a95ad19729b0df65e85ea7abdce59aed99e2db21aa74ed6cd3d3f2761b59b950718604cebc93ec8ab27e6d9f1ce34601
-
Filesize
6KB
MD56584275f0bf8e2b6ab19f90b80b469b9
SHA123f48ff7b2fe840e5a320e57f2962af3e62c5b3b
SHA256c02e5644506f6bfe330206646e721debc8ef340db4c18b848e26103aab6d7710
SHA512a50859aeb9190e26c8b7563be22e06c19fb9c6923990fb11a17d33e279972ac78a3a05aeaa648fe00726f446a2fec44c5e58c5aab8e976ed20c3d2cbe327f31f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5cad7e363b76461c4ae72157c943ac29a
SHA1e2c13b0d0fa743d65fcb5e706d2032e3d099c11c
SHA2565a8ca28d487d51ec2711ce9752fac6c3afedd0f1aa65c7cceac22746906b49b9
SHA5123e8b6c7436cdafcd30b7c440359a76b10b91f49f1e89f68083a51b645f73248a3c74f6246dbf69ec7361bfcada1aabc2b04e922ad9ec3c2b7da3c7c2b96581ca