Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 02:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://1d66b410e4a65340f174a595f828d24cfc8c1b933a291e7895eec34a7af13538
Resource
win10v2004-20240802-en
General
-
Target
http://1d66b410e4a65340f174a595f828d24cfc8c1b933a291e7895eec34a7af13538
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 4420 msedge.exe 4420 msedge.exe 3616 identity_helper.exe 3616 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe 4420 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 2380 4420 msedge.exe 87 PID 4420 wrote to memory of 2380 4420 msedge.exe 87 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 4932 4420 msedge.exe 88 PID 4420 wrote to memory of 3916 4420 msedge.exe 89 PID 4420 wrote to memory of 3916 4420 msedge.exe 89 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90 PID 4420 wrote to memory of 2484 4420 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://1d66b410e4a65340f174a595f828d24cfc8c1b933a291e7895eec34a7af135381⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb979446f8,0x7ffb97944708,0x7ffb979447182⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1051677303135053114,18409493015810359465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
6KB
MD5f49e5b6103fa55557cfc0acb00d9b9ab
SHA1f6dd361b81acbb163e450a53e4b2986a8be01acd
SHA256e9c1f3a2e0792e8d578e7f43f394e1f78de3660c573baeb9e95116c45ef5ba46
SHA512a1611aa09ccb7066b9ce2521d27e474e1e0d99ee3f56db441bfb3d41d794f1103cf1eb9d5ae14781d65617743fa4b7530450703ac2e99d1e2127fce891c23d4e
-
Filesize
6KB
MD5cae7205a487a87f76cf8ebc9a7489048
SHA1e73b1556f6d13e4974c603c3589b08274514e6a5
SHA25691500b750a7bd27ce231455af306cf5b23b5b14c2c390c80fff4a2552d0dd93f
SHA5126381f5fa226e6a0ade2cd880e13bfb01e8b6f4b97e929beb817b51635f58603fbc6722ff1a4f72ef2ec0a9f566b21a5c30ec975ad50adeee48b56bcdeef3df32
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD527a32ae952232c1e02d00bd482a4df2d
SHA1915fcf2582e14ba1b4897c67f03267ea8d25caaa
SHA256af81b56dcc64977e3055a4181b9ccffd68f2acd6a97387525c51e2186f4468f2
SHA51295fcb4924723715dc8b136278eebfb97e2b73d6c3e352b28280ca247ed1da25c97dfd5b7cc8e7979ebd2d6be287d8b80c6822e3888ce3f24ff3a68a2a851cf6f