Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 02:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://wideaplentyinsurance.com
Resource
win10v2004-20240709-en
General
-
Target
http://wideaplentyinsurance.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2852 msedge.exe 2852 msedge.exe 4344 msedge.exe 4344 msedge.exe 1468 identity_helper.exe 1468 identity_helper.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe 4344 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 1152 4344 msedge.exe 85 PID 4344 wrote to memory of 1152 4344 msedge.exe 85 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2432 4344 msedge.exe 86 PID 4344 wrote to memory of 2852 4344 msedge.exe 87 PID 4344 wrote to memory of 2852 4344 msedge.exe 87 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88 PID 4344 wrote to memory of 4044 4344 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wideaplentyinsurance.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84ab746f8,0x7ff84ab74708,0x7ff84ab747182⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:22⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15940613823462425345,17328230008696574152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5a33672d8e2f313335ab621076417d5e1
SHA1aefb2924a91f0555710333b58c61452f0a1a33dc
SHA256e71991201e8be6981361f41000055c12f14567f9b02f284be20b0b0a55e5e294
SHA512ff9a2da2e8861f0169ff44c52be393539a8ff4a220352a72ac7b971e7451c6516078cbb82e567dea30c1c337ff7799e6e4bcedb5bfde255db6a0e225497ab3f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD509588110025da2f984fb27832da7f55b
SHA130e06b8babf9b8d36a05db0b612a2c9e70b864ba
SHA2569c48e965290689a7d2ded6d9239864f10a56a08e4ed048c0534f073a6d5487bb
SHA5120a1faf600808787f67b0f35335524917100923ca35cc04c2a5c3f6b017b767fb6fad1937ef7631f77bd6a73118fc25422943baaa20f65d60b13d6b086c56986e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD54db0fcb280be9d1f9f009e8282ce1927
SHA122ff8457a44fd4903a0f7d70cb83944cbff3b707
SHA25684e170053fcc69319bcd182fcd9638de4ff4a07ceb887f5d735b537943b892aa
SHA512c4297c5903256813794a178e06d383005e97b61304fdb58fd5b98a75d9c9bf55e72fb63cf8e7336216cff89eb59f44ff617072520695659dc44f0d22ebdcbf83
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1003B
MD573161cb434d39bc807baf82e8352c68b
SHA136bd12666733bf75a5ac84e35de7685b195495e3
SHA25655fad744fbf82e7866cdd02473e54ac632d774eac88fcc128aa279f44b746296
SHA512383e2c1e847114f4d774eece59843c6b08c4ea9294670554f43b4a46993eacf792b7bf058301ca2ca6243cc78fb2fc5b1e644caa565e1384396f9e9cda7041fa
-
Filesize
5KB
MD5a635835b0fa2f436a6f5d371f0d1b751
SHA1befdbbec7c4ad9b34efcbae181ab8009f9f82563
SHA256c137032319160f10430c6fb35262e59d504876ab2dd9e1ac5319f9e013f30b45
SHA51241ea789ef476a867a9ee1cbbf5c3838f8ad2c459a61cbc616ee65033efb284b7621277375147e6ccccbb0f5201bb93aa884ee315bd9d02efbada2b2fb4d8b1bf
-
Filesize
6KB
MD54506514100008f522a6884a8f736d304
SHA107bcf09463c8e6b93af6e7cf4072fb64a4e8c885
SHA25683891210dfd2d0d84f312feed47959140ebeee5c6ed35f96c56d0166bf6adaa3
SHA512adb3a05568e30b889ef0e129f672ffc8382c81a21a4faff364b2ce0b9945137dce5d3c8d1132bd048affadb0bea48db2e06b8a4ee4b9ea1d14ff03aaa6f2189e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57fc40f93dc9782809bcc4d8bb36eef32
SHA101724878aa2b42a9e38f1f54b38c6cc2a8f893d7
SHA256973a86f9142c3b94f666554a4043828f096617e87195394536084ff7d4e7a207
SHA512d3736ddf4d1a49b537a39a2677395d1179caeff100966a7ada6f67001c7ca7e23a867991975365ad8925d5b966061b88dc1ebbe3b904453a3ae045f00bb7bdaa