Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
272s -
max time network
294s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/08/2024, 21:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/loxyteck/RedTiger-Tools/releases/tag/5.6
Resource
win11-20240802-en
General
-
Target
https://github.com/loxyteck/RedTiger-Tools/releases/tag/5.6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 6032 msedge.exe 6032 msedge.exe 1524 msedge.exe 1524 msedge.exe 928 msedge.exe 928 msedge.exe 3304 identity_helper.exe 3304 identity_helper.exe 5896 msedge.exe 5896 msedge.exe 5896 msedge.exe 5896 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 4524 1524 msedge.exe 80 PID 1524 wrote to memory of 4524 1524 msedge.exe 80 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 1884 1524 msedge.exe 81 PID 1524 wrote to memory of 6032 1524 msedge.exe 82 PID 1524 wrote to memory of 6032 1524 msedge.exe 82 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83 PID 1524 wrote to memory of 3560 1524 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/loxyteck/RedTiger-Tools/releases/tag/5.61⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffdf553cb8,0x7fffdf553cc8,0x7fffdf553cd82⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,3152832888846473755,8473948647014692350,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4552 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5896
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1932
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:72
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e681bda746d695b173a54033103efa8
SHA1ae07be487e65914bb068174b99660fb8deb11a1d
SHA256fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
SHA5120f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
-
Filesize
152B
MD59f081a02d8bbd5d800828ed8c769f5d9
SHA1978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA256a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
SHA5127f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD58ebcc3f972ed32886a77e80fbab483fa
SHA172505c82c10ae6e04ccdf00c60a13129629ad2ef
SHA2562d395dd8ea204f88b58d78590334b453c4cb308d10ca5a117f813f8ac873a63c
SHA512571d1a69eee11a37f1adbcd55f0a5dff4741256c3720e59fff582b02baf27c163454ea77a9844740bca6d3c2a7e9b6d7dbd526d8d0de04a224041f0b66865401
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
496B
MD57e94eef311a6778053e0f2c7316d4a4e
SHA1c3c0bbc8c947db2654ac5857903a1733196a93e5
SHA256430b64782d816e293bb7a8b12e49acd5366b5f3a6508429a05600269248601b5
SHA512ca3a9c084e988e4bb968960e2480fa89c5a6c72f1d3810138695e243a3ae54b22e4041988c4de1f817a6cf8c289652e60c19671292c7a4d5c7939097b3a94b99
-
Filesize
5KB
MD5c8cef26fb134e19faa57a59cca021422
SHA13ffa25ffd1c911df2ee4990a56645691f9a779e6
SHA2565dd712a43b409b94056b2d49998f197e024bc0ec378c22636cd3145993d3f94f
SHA5123a5e3c9fbfb6812483a036f85c53c912d1faa3f1c27b5a12aef44163df11eba9b8bd5161eb4fc6c2deebfc8b46de5bb03e29d28204fae17df9966a1b257c0297
-
Filesize
6KB
MD594b29fcdbbf93c37771b8b6c7351328b
SHA197debd64e17085e00023c7a310c7f92ac590cecd
SHA256568bcdd4900388485722fb9d94ba5c66392d86d427a0622f87f6e25bc6b9b385
SHA5126d236bbbdc612368f261720d48070b83ecea16f6ab3e25ce925b5b3ed1dc9ccb995da9cd8171595c8b7a94105769a7e3b7b91d7d85eb9c5a786cae0b283ebaa7
-
Filesize
6KB
MD5eaf96f7c30093238248480668797c197
SHA1070cee6fb3da27e806b89d53b9d3a04a043e5de8
SHA25690592cbebf387704a0cc15459c987a4643a660ca7dad28b42aa2cfe8e45d2a66
SHA5120b78fec0ebe97d495641f2168bb5798e0210f7f3691cc066f6394c2160feaf3c31fef3919259ed921f5763a6ec095e33601e0ed223eb31545422516cffb52dd6
-
Filesize
872B
MD56d092e454017d96a664ba5373459ce94
SHA1f66a02c75535bc35adc7250df0ec6f8726a871ff
SHA256461fdde663af51c04754317104b573cb1ec65825b11caa1fe4d130034540df9b
SHA5124c44dac07049eaf84b468b0d9a75e96cb88b65ee6c7967c5fe8b1fb47dc7b91b9abe9476effbc9b682383091a4c155bf1fcaf4a66c5618e3f65666495aca3384
-
Filesize
705B
MD5a434ccc499feb6d5938abdb6a877f826
SHA183e875e2d8b149e51940d8034072983583c309f5
SHA256246aa11d070f6f8c7f166f1ef4514b1ce96cf4e42c1e3edb002531aae19ecee7
SHA51252c5b25666e11b5e6b5cfcd3e4b167d39f5254163040c9be79d38fc5047e20f97521c2c3a7b06520a803b1b5c40d4f4cf4ebc4902f604c206bf68004bc044fda
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5b01dd2cfe18f215d6ed9baf09d69bf19
SHA17a0b80c501c218eb0d47245fc82b68b1fbc8d927
SHA2564db505fc3029e5c633d1cd4231f81a4da78a80c71d9ed16cff87731742bbbd4b
SHA512a93edabff474d1eddbaf2b04475e41b0eab89a6c759efbdf6f88fe3ba214d4e689393b506b3910b7abdcc2931453120f87e1ad84c8bce70cf10fbc4fcc615f1e
-
Filesize
11KB
MD5bef8323a7a7f1c6d8e7197aaf7e08725
SHA1691c32dac14366aeaf4e57e0dc7cec2146eba033
SHA2561cf0e33be118c55803439c76b9d780a728cdd44e26f32a1fde7f1aff1d5acc23
SHA512fbcfda7d56182aea8b038aa9e9c9ec8128bbc14f88d96451217b9c1f99c2991f1f6b1bee65decfb013d4d07661e57b97ed685596be0070b2d93bbcb18c09e568