Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/08/2024, 03:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://regautorev.info/myprofille
Resource
win11-20240802-en
General
-
Target
https://regautorev.info/myprofille
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 5836 msedge.exe 5836 msedge.exe 3580 identity_helper.exe 3580 identity_helper.exe 6028 msedge.exe 6028 msedge.exe 5908 msedge.exe 5908 msedge.exe 5908 msedge.exe 5908 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe 5836 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5836 wrote to memory of 2688 5836 msedge.exe 81 PID 5836 wrote to memory of 2688 5836 msedge.exe 81 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 4084 5836 msedge.exe 82 PID 5836 wrote to memory of 3244 5836 msedge.exe 83 PID 5836 wrote to memory of 3244 5836 msedge.exe 83 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84 PID 5836 wrote to memory of 3124 5836 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://regautorev.info/myprofille1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff36b13cb8,0x7fff36b13cc8,0x7fff36b13cd82⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:22⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:5244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:12⤵PID:5344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,3371668445776723585,11478508670836685701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5056 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5908
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2700
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e681bda746d695b173a54033103efa8
SHA1ae07be487e65914bb068174b99660fb8deb11a1d
SHA256fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
SHA5120f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
-
Filesize
152B
MD59f081a02d8bbd5d800828ed8c769f5d9
SHA1978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA256a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
SHA5127f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD54e2be50d6922a429c6ae8058c3f47a1c
SHA115ac3e7e1b74b9c723d26fb45a3ce2496782be9d
SHA25637fd3dcc1c9ec2815575af9902e5b1b93e81d7acb868aca10c8678009e9d0ed3
SHA512ba6f865b700fe07e16eb79f4db8af4689a0d6e5a16019c64d8abe89ea861ca3e5e4b8bf204463b4070f125bd5ec54b7dd3850b945bd7925aa6442bbed23d2e1d
-
Filesize
472B
MD50abeafec01dab7b8e731eeddba519a3f
SHA145d219488014864cfce1790ed4ff09802473e55f
SHA2562c5f2067769240d1e2de8132457e8cb976a7c8c3161eecf2a6edc9d1b42d2db9
SHA5124f52b8bac7687707b501245c5c6d044379a791dfac76fa5a9dcf9622abd45b22b7249bf466aa33ce3c95a15f5c194a57ef06bac5cb8c2fbd2fb8a6e1e0eff164
-
Filesize
5KB
MD5c32e60415bc5f13f177ba1c878ac0c5d
SHA1c21011ba164a5d0ea98020f70cb0d5fa5ac888d2
SHA2568e67b8a80da03acd71ec801073ea05434d83a427045f6dcb050b7abc51ab8034
SHA5124fd03cfb30c50b376a8273afabe1a6fc35a1e6142d9aea9a5a315a7f81c1cb92b018db118731c58f802fd903a070ff307b0d9aca2f20bc9882f86fc27428561f
-
Filesize
6KB
MD5da6923ec4feccd75237c976a4da54b7f
SHA1d32adb880d931db83ebc5fb0a598840244170f1f
SHA256c821396e4e197bcaf56cab37baeb3b6d395a6c0ae1986251aa23b7f47b06c92a
SHA5129b8d3adcf5ddf12a89ac61c76ec9126e053dae849446d1ec1ae4598991244fd432f28058dd9e95eb53ce87e418449e9e89364dd9d9ef45a2bdeaea01cf2dbc35
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD575d46a3b1988c3e971ab940cf96721f4
SHA194e90db00c0b780f76a2742d8ff14f251eaf72d1
SHA2569b347e54e087dc5b59fd036368b8b2577b056e88c60f55b48e85ba8fcac238dd
SHA512a8a373aba9bf7fcdabddd8ef5bf5981a9475062e8c6f6ca8a6bc5d75e6fb55fb357bd8d5a6dc70bdaf1492999418d5e657110798156b8dcd163fb6fb9bde98ee