Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 14:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.yyybbb7668.cfd?invite=MDDC99O6
Resource
win10v2004-20240704-en
General
-
Target
https://www.yyybbb7668.cfd?invite=MDDC99O6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2180 msedge.exe 2180 msedge.exe 4620 msedge.exe 4620 msedge.exe 4644 identity_helper.exe 4644 identity_helper.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4620 wrote to memory of 4652 4620 msedge.exe 81 PID 4620 wrote to memory of 4652 4620 msedge.exe 81 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 3632 4620 msedge.exe 82 PID 4620 wrote to memory of 2180 4620 msedge.exe 83 PID 4620 wrote to memory of 2180 4620 msedge.exe 83 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84 PID 4620 wrote to memory of 3112 4620 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.yyybbb7668.cfd?invite=MDDC99O61⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9650146f8,0x7ff965014708,0x7ff9650147182⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:12⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5397475705415271271,3230185222750765204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1072
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e81c757cdb64c4fd5c91e6ade1a16308
SHA119dc7ff5e8551a2b08874131d962b697bb84ad9b
SHA25682141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3
SHA512ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd
-
Filesize
152B
MD52e57ec8bd99545e47a55d581964d0549
SHA1bd7055ea7df7696298a94dedfc91136e3b530db8
SHA256a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
SHA5126b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
-
Filesize
6KB
MD57bd8a101985be4bdc6ed186900e7f3f1
SHA177647e8b21d88fc3cc25cc213ff3830a699321d1
SHA256fb6a3f534b47401e6d14e0cbe5bc2d416e55106363accd2dd556d2755d08bc71
SHA512322b78d0edd611e754570e784630141d36eae8acad8b95523692b40422fa3fa76606a607a549816ed34035b0db972da8eda792fd31f51a539a8a19bdc5b6fa40
-
Filesize
6KB
MD5d2ee6f57083ba3537f58b25a7061cf3d
SHA18924260bff69beff2b59b56704a3dcfd919940eb
SHA256e193a684f300de3f628cbadb19c90812e47e96a88dba89e8b611ec773c0bc2d1
SHA51225e641ddf3d45fff12efbfd2f8ad4368928d0a5a7c7b77fa470712d20dc992f4556695547291b5b9ecbc2d2ed89b646351855d694fcc6973c03b578e04d5737e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52e715c6e5e3795333dd7f3ee59f14d2b
SHA16cfc17b90bc299600e12cd3c58297caa808a2261
SHA256b310093f6b21d073298d409d8f55ada1335b081fe64189f45fbe72ec66b3ef87
SHA5122a22dd96badf715baced4d2a883801a1ad1f4df801514d20185ccf4f90fa5713f795769fc8fc0b199461bd073c065f704283ff7ea400a0a5a75dd6e5395edd5c