Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 12:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://1.1.1.1
Resource
win10v2004-20240709-en
General
-
Target
http://1.1.1.1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2992 msedge.exe 2992 msedge.exe 3420 msedge.exe 3420 msedge.exe 4168 identity_helper.exe 4168 identity_helper.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3836 3420 msedge.exe 83 PID 3420 wrote to memory of 3836 3420 msedge.exe 83 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 1412 3420 msedge.exe 84 PID 3420 wrote to memory of 2992 3420 msedge.exe 85 PID 3420 wrote to memory of 2992 3420 msedge.exe 85 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86 PID 3420 wrote to memory of 1040 3420 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://1.1.1.11⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd50e346f8,0x7ffd50e34708,0x7ffd50e347182⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2593150125590997539,494379971177662813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
Filesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5b58637d4b0e1fe30efefa5619bcb33a7
SHA168d7f878abf0298d4c21b271ad1b7f9378c3d36e
SHA25659747878724d5385fb352140c3874631ee475343dece0b2e20ddb8766ae5a935
SHA512114f016d8382c5a40474f2ee9213d105cb604ff38205d5d039dd2c34ffe450b9120875f32aa7675f9d4313239da058df11755cc4c170ce21501340b97fef623d
-
Filesize
248B
MD522e227ca2ce5234ece7f0998c2d82060
SHA1802faf48f5d68f9a05a35aee56b508120408bafb
SHA25648c91ddcbb24b59a3b4eedb0986913137d3b7926fb2ebad657e29e19d4e288d3
SHA51225c2fa41315021b3294fcb0dcbfcc02aa6a32cb9cd48241ec0d936dda7854c4a1975de5dbdd086f5ed612a8635e25aa4e48592084c9cb639c841f3208821a2cc
-
Filesize
6KB
MD525e552144f65b54f94af08c40a09bd01
SHA143c7a2d7c34f3c47c71ab98005816a6de7c961d2
SHA25600fb7f33b9f8247907f76e6f54e49356d970cf0a715df8b481df981f22e7d860
SHA51219e8041e0efd0ceac7a44b126408ed61eedc31e9e12ee8346aac89350291b9c546b0ffdec824224434c7aa185faf5fbe8482ced094feaa8333c3029c9ddb6782
-
Filesize
6KB
MD547247991ea4967cf5cb4b5901edc5f08
SHA1fdb147c4114590cd252396e61535af1387968889
SHA2568b2c2624439dd61a331a480e154067541fe1ea62c952384b2e5800aa6493706e
SHA512c23b5907b099451f3b439663f3f35995276b82667ebc1c165de6e23eec09ddf0e560e03e14f49e048e941d8b3c9dcb50fb4ba621232ab996f66dc9cd217b2b5c
-
Filesize
6KB
MD57a4026c45e7373ce5b3e8ccfa98a4db4
SHA1bec4d6397f7a6df8bdb4c214a229b493eb1c10c1
SHA256d606640277c582da9caf1418b9a812666c3ad4a283142303c701a26a850e55fd
SHA5122a63dcc20dae0ca9b48ba7d40579a830a7847a109ef924380394384779942bf9866e31f37bdf41f710e8ea6703b893cca68dd2481967dd2216f245572473c0d5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b48d46588ea2d956b107b349fe72899c
SHA1cb87f5e7419579474f2c82c22daa2b09895b5391
SHA256322eeceae854f898f7ec7869eab816b53b188e69d433fc81feb67529ae7484fa
SHA512df1c64ca42640eeff3f44bedcea71c37177b0cadf327d2cb608c813e76029a7687dbadf23d3ed27c77afc1933baa72981f911f53af36fdfe145471760392a87e