Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 23:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://pornhub.com
Resource
win10v2004-20240802-en
General
-
Target
http://pornhub.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4036 msedge.exe 4036 msedge.exe 2044 msedge.exe 2044 msedge.exe 3648 identity_helper.exe 3648 identity_helper.exe 5520 msedge.exe 5520 msedge.exe 5520 msedge.exe 5520 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 4220 2044 msedge.exe 84 PID 2044 wrote to memory of 4220 2044 msedge.exe 84 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 2200 2044 msedge.exe 85 PID 2044 wrote to memory of 4036 2044 msedge.exe 86 PID 2044 wrote to memory of 4036 2044 msedge.exe 86 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87 PID 2044 wrote to memory of 2340 2044 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pornhub.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ae1246f8,0x7ff8ae124708,0x7ff8ae1247182⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9053829814115523411,13639821595013093819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5520
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize792B
MD5ff5b7ff7174dbbc3ed607951f1e388da
SHA1e52442242db01859d487224309eb94ebae66bce0
SHA256e9ec30f87ba515fb4c6ee0c679519186d7d805fefb3a41900b5b752bc7f020a4
SHA512129db37ed46d336fb6061ebb443b672db70d70c5dba30c2aa4e9c5ff74178539c4f6a3d0226b03e7e7cbdcea73ff8513014ee471954af1e57fee28680701a69a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5d58fd01c72560691de60f22778f7d429
SHA1375138922577b648925ad8293272230b3d129b30
SHA256efb0f5df2a31af391aac6d600afaedb705bb5ffb8a4518d03da0d7202bcdccb9
SHA51239d127c9a4a31a4ceadaf530d6b3e85b3861251202aa2cdf9fc9a87b7a78a39d6f64f6995e734e16a41a335afa28a2b3ada30f8c5320a1fe7551169c422018c4
-
Filesize
5KB
MD5be2c3a23ef27d6e65313eba3febf6d06
SHA1f51d2a718fab7c785eba86038ec84bcec7de7628
SHA2563d89e47b9e060b4b82595c3885514d4489064e3ac28a829d9d178096bf2be0aa
SHA512943eb5916fce0f74ea58308ddeb8a9783c6078a634c1f30c234a9b573bb77f7d45f1fbb9b16192c9882845ad09e764f1a26f9181ba6b2a983b94dcb2b1c42228
-
Filesize
7KB
MD5b0d721fa63e8b62dd53b956c0808054d
SHA1724e072e450204d89efb8e6c9de35c2a41d408c6
SHA256f117595d3b4fd0a870ae0db685acf465c6b3906411894e5c79ce978e804d7817
SHA512de84d36ac75c58ad8efa2428cf0403e421427ddf4de171031e1c3c81afc67efa3c835bbf0f21c9d7281e7c1726c5973ffa6c654f59d8f512ed2d4322aed50245
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD53f975ccca8d4c063afb09815ae9db141
SHA11482d8d8b2be40c002fdf64b36476de066ba57e3
SHA2568d8d1199d067e7a338f64382cb6e2607daa59b746fbf3f5b0f7cfacc5767869b
SHA512d0afbbe5a542474e0b4ac2364cf7c47ab85066ecf51e7ef83c4e1d0c0cd87fad2ebbbef5be4aa855126fc32a548882df789f9dfbf1d69869a5cea9e441efbd2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ef03.TMP
Filesize48B
MD53a408f3293862dadcd4b7c75c1e45982
SHA15e693359cd30fac56114c172f2484ab7de182829
SHA25629f0f9595712198f6723ee92620f1a2fa364f32757b607ce59c6907e607fc756
SHA5127956b60b530871e68ac3cb681e66f80ce40398445ee703d4da7f19b45af2f602ea818742e0a95923a34d8a634db535395fd1ff7d32be231e827d156768e1f640
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD55ac0e0fe37fd637cc45e162fed31dabd
SHA1576c958cd2f8c55343039128303125340b9eda3a
SHA256eaa612201db13dbe8e1e0523f97c3955f9ed0d042470292065bc2a5f17c442f6
SHA51281eb21285d728015af51e5167391c009edcbed98390ace567b6ceb2b533a496c3232400bcbbd180b6dd8d7caae8b08c71e3c2aaf5ec4e4a381ed34765cdd301c