Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 02:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/drive/folders/1dEpMvNi5d696XS4wxuFYK1gKpzUFZ1xR?usp=sharing
Resource
win10v2004-20240802-en
General
-
Target
https://drive.google.com/drive/folders/1dEpMvNi5d696XS4wxuFYK1gKpzUFZ1xR?usp=sharing
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 drive.google.com 2 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4080 msedge.exe 4080 msedge.exe 2052 msedge.exe 2052 msedge.exe 3436 identity_helper.exe 3436 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 4744 2052 msedge.exe 83 PID 2052 wrote to memory of 4744 2052 msedge.exe 83 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 3800 2052 msedge.exe 84 PID 2052 wrote to memory of 4080 2052 msedge.exe 85 PID 2052 wrote to memory of 4080 2052 msedge.exe 85 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86 PID 2052 wrote to memory of 2652 2052 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1dEpMvNi5d696XS4wxuFYK1gKpzUFZ1xR?usp=sharing1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0d7746f8,0x7ffa0d774708,0x7ffa0d7747182⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11193722040866999067,598659720329743946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:12⤵PID:2576
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
5KB
MD58015e5bd0d441b3242843b352f71cb95
SHA12770d8bef2e647d33b29850c8ff2cf44c970be67
SHA256434ca8bf2bed7a4052dc5b5e2e8ebe6ade34c6643c1fef74ada199949b579bda
SHA512ce0c4d4fbcfbbd5a3de2cf1791c3e0f6d88002b2f93d1b737038e67d872e24a86a5779391b295e4dfc7eea31fa6aa3f1e1f28a9e26fc2fa88128c8127d5b020c
-
Filesize
6KB
MD5f3069d05becb10c682d85bbd46420392
SHA1151269c34c4c0a5aa7f90c75d2140ea1046f052a
SHA25689104a3f30c4f76d55ab48adc7187583c527b9486f9fcfd648d988e17b1748ee
SHA51298efcca0ba47cb37fb514005776a3453cf4a30a2bf01735f40d0e3bdaef654e6ee23eba0d1bc26bc2a5a38f6d65a5c73e48bd4b6313f17d238ad83e948ef74ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5553919509e040b6f5ff1cd01a735f9e4
SHA19d9c0a60e34540cdb1fdcfae38880fc49bc656fc
SHA256856ca35422087855cce53d0dda251a18d2fb148c631c10cf6b82df8280dbf394
SHA512f50a0a5ff038419ab06981eb673a7f4aaf472801fb97d3c021072c2ef898d1498a30ea9a89b6824941c56822607c3c546a14c4ec66a4d9f6e1a7bd298d23c4ba