Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 08:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bit.ly/3Ljov8n
Resource
win10v2004-20240709-en
General
-
Target
https://bit.ly/3Ljov8n
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 3660 msedge.exe 3660 msedge.exe 4884 identity_helper.exe 4884 identity_helper.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 1888 3660 msedge.exe 83 PID 3660 wrote to memory of 1888 3660 msedge.exe 83 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 4356 3660 msedge.exe 85 PID 3660 wrote to memory of 1388 3660 msedge.exe 86 PID 3660 wrote to memory of 1388 3660 msedge.exe 86 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87 PID 3660 wrote to memory of 2064 3660 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/3Ljov8n1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9303046f8,0x7ff930304708,0x7ff9303047182⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13231170087034859676,16329413702024410757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD503c972fba2dd9ae19dec098e294433b8
SHA1aad5bb596319507b156d8b827174d6227d0e0c2c
SHA2565798aa424b40b823741dc6dc3eb70e891976a34e8a16cf35409a9d3aa7e0e4d1
SHA512eabadde4b5a3595dfbe7fbd0e95da92a34c77a3eea5277c1c02d72d331362489f52debbf4f790706c190c92aa97c327f8faef64bce137e950e5c4713e7c34664
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5692d0e14cac8ed21a8fc25631d438369
SHA1adc9b4dbaf6d5771ee9f42c9483277b8eaecd9c9
SHA2564263196a13a5a187fa6b340fb59462c4164a7e663e64d6cfe351fa0722bcb44c
SHA5129c956ba71d1c0136ed9b51e3a99e1f6a35de69d1b3bea8241bd7982bd2b9565f5fecb4705b7cc39447aa2027ba9776246222e19b0a23b09e88b676204d2cf898
-
Filesize
620B
MD57a80a0009a993ddae6b1751662628642
SHA1ce91e762b9e52559dab2e11ba4547bdf2e52743c
SHA256c4b7e5d7d72e01c8f5f41797f734030d22d74ed7ac8fa119de99630a9526c50f
SHA512bcd20629e996865fd5677fdaa12f78dee2f2182647ce4979a958c99bd8da28fdf5aafd8677d8b38ddb1d7b015bc0149737e5c559241a03da1d0ba9b5c96d1ca9
-
Filesize
6KB
MD587ad93e14e8d849fc3f7cb198ac899c7
SHA1efa7ade7e81a3b0af1c7f82a0c5d73d587da035f
SHA25658494be87727e26b41b2afca20f79c10eb18609f8f14a36d40d884eac3fc7955
SHA5129ab2aded0e28e8e7be227e75cdbf06236db9a675500cf0c65a14edfeed1da6d5c7b535f11fb7473925e5e2a96a7f9c05d23d491bc90a9f0ac87e444d9e4067ae
-
Filesize
6KB
MD5bda855f0cfe6b12976fb69eae78f95bb
SHA1f5a470af862807d4b1dbfe2905d1201d39bc6d1b
SHA2565801e6c0dbf4adf20b34c71113e0ca8d8b84906951440d0b1d7fc21b6d5be08e
SHA5121be25a23558f4027e306af53f3d8c5d69eb694d0281947c606aabd26bc45ad66d591e1d57935779ddc1b577635bb0fbb5c2e6420e078622f51d7156e3f2e0a95
-
Filesize
6KB
MD57f88defc28f5f8b8903b32bd50894033
SHA1688690caa7e3a71bf76537f8038627960bdf5346
SHA256d908baf195ab4cfd0e72888fa0e981d732f111ed2df56d892b5c5d7faf875d96
SHA512608f5fb7c69a6f097394f785caabbf221634a7e736a40f98bb6e8b0df6b7d1cce89b61f14a83acf97210d94ab2820364064cce16d3a2ff35214e86a167703dfd
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c972234196f6ff2e7dcbc9aa83454615
SHA10a418329457377b291be14bd856cf22c08359819
SHA256ad3bd0ce6f5cb06329942f9da1a09733d5f92e747f74ec4eb28338dc82e0536f
SHA512b291ecec258232d94f52e53bf25c49fe6eb29c802dcc68ac3f8c7fb24de91f5ef29d063224442ebcb5ec1d277154a57428de7fc0b09ee7d9119e160898e43519