Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 20:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1b6695We0MJyOl2c2kN_2_4TOJc2699_i/view
Resource
win10v2004-20240709-en
General
-
Target
https://drive.google.com/file/d/1b6695We0MJyOl2c2kN_2_4TOJc2699_i/view
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 drive.google.com 14 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4956 msedge.exe 4956 msedge.exe 4740 msedge.exe 4740 msedge.exe 4068 identity_helper.exe 4068 identity_helper.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4740 wrote to memory of 4040 4740 msedge.exe 84 PID 4740 wrote to memory of 4040 4740 msedge.exe 84 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 112 4740 msedge.exe 86 PID 4740 wrote to memory of 4956 4740 msedge.exe 87 PID 4740 wrote to memory of 4956 4740 msedge.exe 87 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88 PID 4740 wrote to memory of 3188 4740 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1b6695We0MJyOl2c2kN_2_4TOJc2699_i/view1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb63a46f8,0x7ffdb63a4708,0x7ffdb63a47182⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16557493282705406058,5812796830457770438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4140
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bafce9e4c53a0cb85310891b6b21791b
SHA15d70027cc137a7cbb38f5801b15fd97b05e89ee2
SHA25671fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
SHA512c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
-
Filesize
152B
MD5a499254d6b5d91f97eb7a86e5f8ca573
SHA103dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
SHA256fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
SHA512d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD5e2dca8f965813fa2e1443a7c2e8d304f
SHA14fa742337999f2a083e47fa663e7103cf95b92a3
SHA2568773cfeebab3df226e68ddec8ba604fcefb0b8e033fefe31ad9d42751637c793
SHA512c6c0853ed4493122e9581965fc4cf0f38730fff0f2f88ef08ee08250f9aea85a3e7bc6674ef96e1f79fe71236a593f06fb86d30d8bbc79fa0a22e375f0ab49a6
-
Filesize
3KB
MD531c4ee489ee37396a93e20ab96c2a4d2
SHA149e1aa01aa6c6b6396c0f141374ec82a80912e3b
SHA25696c7261ba1403734f560356f31a105d648dd2cabd6e1ec770ed9e14109941acb
SHA5129a42567b433206cbbc100618c33c0f2a1267aafb5a1bc8863bcbad289790eac78af34eafaafa52f899bb745855c1fe1a9c8c36ffe913cbbf531d8777b0545c82
-
Filesize
3KB
MD54e072d97c6c425caf3937e75fcad32af
SHA152736d54b6b9aa9365c4d940350978d133fa6463
SHA256e21572558b62c735bec1b46611b672527242bd8d705ae3a1ec1e43edfefeaf57
SHA5128f423aeb327500a5ec2088bb8a91ebae454510fd19178a93226ed2a4435120f5afcb82a78fe09658a9600ac01281b7045b93540f1ecfc93b064c0e6a964251e6
-
Filesize
5KB
MD5d89f2769fa9710c05bc9f619975545fe
SHA1dd2d21480d9a7446212c4a0ac15d82443f3554e2
SHA256fecb2bd73afcee681963dfd0d58f683b3560df3c7cee82d8891b6f664a13a0b6
SHA51223c0179b095fbb8eff640093db17a983879b828b866830d4c15e0ca82c5dae84301757a9df68ae6a29f898a260eb0f4ff571dc689312eefd6109cf2e8c18577c
-
Filesize
6KB
MD5e15ebc6f211adeff23fdb9f865bf58eb
SHA13b57d90333b260decc7d221e1e161d4260b87a3f
SHA2561e8ab4b77eb61663a258970200da981daf31f5cd60c2959e580cdf6106c647ab
SHA512f1cd5bd44205ca382e109db1e430e6a92cee11531eee622f745c4ea144823d5b78a028cbee96573dddb54db62fdb590ce83c95256d38dc1e7a9277d3ec4b7cba
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD58e6de7df2702c557c98e79d3a53f97cf
SHA159e7bb9257da398bac75a3dc83c5fc915c8721f4
SHA256a9847d4d64143c659b9fda5341517971a8b664296b929ab855099974ba6041f9
SHA512c8884b743b8c5657aeaa9a5438d2beac8a3b47db196f3d28de3153cb1800fc24a55cad803d026250a5cf724e027f4c7024a32f09334d37eaf6b869c0c43a7d01