Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 13:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link
Resource
win10v2004-20240709-en
General
-
Target
https://drive.google.com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 6 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3528 msedge.exe 3528 msedge.exe 3096 msedge.exe 3096 msedge.exe 4652 identity_helper.exe 4652 identity_helper.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 264 3096 msedge.exe 84 PID 3096 wrote to memory of 264 3096 msedge.exe 84 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 2660 3096 msedge.exe 85 PID 3096 wrote to memory of 3528 3096 msedge.exe 86 PID 3096 wrote to memory of 3528 3096 msedge.exe 86 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87 PID 3096 wrote to memory of 3032 3096 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba97546f8,0x7ffba9754708,0x7ffba97547182⤵PID:264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2360 /prefetch:22⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17085747422647635203,10876066372977711214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA169ad27d9b4502630728f98917f67307e9dd12a30
SHA256578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
SHA5120e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
-
Filesize
152B
MD554f1b76300ce15e44e5cc1a3947f5ca9
SHA1c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA25643dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
SHA512ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD5d460d7e205941a0e1075e9bec4189421
SHA18144df84a02ecf4b4b7844ce69d9455787c6b5d0
SHA256ff3a9737902bb5d91ffa707ce4264edcdb3e083a3576bfe3437fbc59fb34728e
SHA51281fbb66e8dc7b96e5dcd61028fea9752bfea467595a2588f64599552b18d2e381635b613ec256701e491f032c3dc0667d5edfe6bf6414fb309ef7c7a788c29eb
-
Filesize
3KB
MD5e97ede6e67fb909f53a11acc3799402d
SHA1ca9d9fa93fd15996edf1cf4784b38c3104bb9cc4
SHA256533c027792c175d290e460b963ed085a84228658d40dcec4ea5d6774d43d5147
SHA512fd6a339476166d7e7458a05833de76173be613dbdcd4d0e4dbbaf2e532b0a9623764d34cc624f6702c520bc045ab5fae985a2bcab25c1eece9fa894e0d487aea
-
Filesize
3KB
MD5a90b850ec0a4f1696b10dfaec29a7aa9
SHA11eec49eebdc618863c9a6cf2a70a606dc2a83c15
SHA2564a01a4237c4d9975646bfd1f5a717b77582704af9805d34cdc1f5ad5f8cbf405
SHA512ce4e432035d202b7d388b078cd1406e23e17a696b0df3dfd6c2e02a157bdc390e6f7f805057612d20287d6d2e17edfa3ce6d5c14ed8c4f87d087ea4b816f5109
-
Filesize
5KB
MD5acbabf1f85a20413d14ceac9b8d901b5
SHA13c8084c14d913414e5aee7e60411644f09773b64
SHA25664333735cd41dc6bfc2d5be3b828b341df2b005e6f1be82c597570e3114931f3
SHA5121b6451908dd9113d4fd58e7c0d1a18ea71693d6e9b181e585b1979332e3322adfe4fbaa7dbe829ca1944203586f025d57fa643cdaf221678713968546df2152c
-
Filesize
6KB
MD521d18a86d7a4e5e331c231aff1abe8af
SHA18493aa96dadfb46fe7437d907d3adcb96d7740bd
SHA256dc5e96531aa2383a9442c341a319b0db6b280c4312ec81050b70d573d0b9cebd
SHA512a2d33865c915bf8a7be95ef8958b6e4c365cc4aa0769fd1f37e7b54b300251f817765dfc2487678b161e621eb07317a251fe7ede9447c93ff326affe24cce8b3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f05615601d1a2d3ed9120c7332b73684
SHA1684009aa11bfc32c13949827305b1f21488784da
SHA256a647391aca090a91da41da1228f6b3371406ef021608fd333c5db83ac4e525b6
SHA512a7dcb2301051da07d05f63aec074d979e9092f3de5afeb6a4e59d6dae1c744bdd79b2d8c6a0c440f03de6a31d2044d174fc979ea9c293b3513ffad763df5091f