Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
960s -
max time network
1043s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 16:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.cupraofficial.lu/carshop/w/configuration?id=ePl9IIpVw_Cws2OQj6efq653kKETiucdfXxAgs4WLvpGsGjHEhqOnrrhrj5AOTdDEwUXSxdQqLqZmimAgKMnkOMeYGEMRCAWUCFILe7wgxsG0xRbCwA2dTDE
Resource
win10v2004-20240802-en
General
-
Target
https://www.cupraofficial.lu/carshop/w/configuration?id=ePl9IIpVw_Cws2OQj6efq653kKETiucdfXxAgs4WLvpGsGjHEhqOnrrhrj5AOTdDEwUXSxdQqLqZmimAgKMnkOMeYGEMRCAWUCFILe7wgxsG0xRbCwA2dTDE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4052 msedge.exe 4052 msedge.exe 5096 identity_helper.exe 5096 identity_helper.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe 4268 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4036 4052 msedge.exe 83 PID 4052 wrote to memory of 4036 4052 msedge.exe 83 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 2240 4052 msedge.exe 84 PID 4052 wrote to memory of 4032 4052 msedge.exe 85 PID 4052 wrote to memory of 4032 4052 msedge.exe 85 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86 PID 4052 wrote to memory of 4248 4052 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cupraofficial.lu/carshop/w/configuration?id=ePl9IIpVw_Cws2OQj6efq653kKETiucdfXxAgs4WLvpGsGjHEhqOnrrhrj5AOTdDEwUXSxdQqLqZmimAgKMnkOMeYGEMRCAWUCFILe7wgxsG0xRbCwA2dTDE1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cd7946f8,0x7ff8cd794708,0x7ff8cd7947182⤵PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13082946487964495649,15323624583800602608,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1008B
MD59cc3f23d340fd55ac86a207aa65d4b21
SHA18d06f202029b5da36adec973a4cbde19f84f83c5
SHA256740473971f74496b72f55cae89191b3c0fc7552cf082254251afeebd3c15350c
SHA512830af1d15d5cfcda925642a333843e8c833b87b622dd3fa8695d394e80d2bfc9c3ee31e379eaae4c8da6b3066ea0737bdfcdf08c1bba224be5650f28192159bd
-
Filesize
1KB
MD53035b161f023e8d0d55dea357e997860
SHA1c6df50fdc0534d6780b809f1bc66734500f0695f
SHA256a9f477886a41584008f4c28d8cdb243a9f859af94daa3c4e3aa15b236e15266d
SHA512b9ff24479927d52a27d26c79a86b44242e6ef4213147c433d5f59a66f519dd13b70ddc327216a080ab15215854ebb2539feab00f84254e2d0d159cd1333af544
-
Filesize
6KB
MD5b1b533033498d8155421c06acf1b0598
SHA1667323ba5761bb16242b0094a865298c141df942
SHA2560ece30c3c0a4038fadbfb39d76f9e99fa0b7c367b327e82ee9f8b5aba644fcb5
SHA5121d7f570770a24211c9a91d3a125df2b3c6eb21abd6cd9c917557fce02299521ae14ecee97bb1c790d6f1837dd2e2069760a0f7a5ff8e91fdca98db237d70cc11
-
Filesize
6KB
MD5bb37650fac7090a46aa44fed59f09bc0
SHA1fd6e5e4db84bf01509901c98fec5d4f9eaae4da3
SHA256d204605a9bce6d3382409505389ab9074e92effd58942d80fbcd2224f327ee97
SHA5128e442e8a4462c28c305f1196de1e1adfb3921158225b833750c4cfec6d87e538827e7534485d5194d5507e1873128b6766ee09722de91d5f1d1c954747644f15
-
Filesize
1KB
MD50ecae942ddd255c0426d9469e52289fa
SHA15c54f8432ff37805e8331e9b49f37d04823edf57
SHA2563f8d52222d7063b76528fd0f29278a4233cbf1cbec15226b26ad4af9c13bef4a
SHA5122165fc44990de05d00fc6c2eb3d0a6c4ae800c1452292006eda6134befc77b3b9f837151bd1a8c2a7e5dbc1fe30c55d24af02f08c0e8d381133154f4fb7bee21
-
Filesize
1KB
MD5d620a2bb65bd58e22295931fe846a46e
SHA1c9fccba7ba77ce18e6cb9e4aeb3e372a72288875
SHA256302a7b997ad34f056920bc054a28171a7b245533e9dc4b25b247e745890c65fa
SHA5124fe4595efdfa7429f0886c812f9deb0b9ad9286093320a43949ad2d2bdda2282e6dab6ca90ea5ce55e3c2db33d40558187b2fa623329e723bb46768302acb4f3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD500b2e0eae98e68e8ee85957be04442e0
SHA14d3a11a3bcf9a111615ba654761f2e19872beb2f
SHA2561b80a5f229e625b4b08e67473ceda79fba423de8446eca8e20e66c3405f3c6fe
SHA512d6af6918a3f626c398d1d0aff5a84008a9cd808f08d31d416017e662afb454703c694924b87d4a0c1c45cc1a178c4edf448e9ae5c58713a90132f97d92c910fb