Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 17:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1276990209430388839/1277216490260664381/blue_tools_2K24_2.zip?ex=66cc5c0c&is=66cb0a8c&hm=cfecc5683bab44f5f0516122af36a0d04084c2aa2c8311a0fe47e3e920f6ac38&
Resource
win10v2004-20240802-en
General
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1712 msedge.exe 1712 msedge.exe 1344 msedge.exe 1344 msedge.exe 3004 identity_helper.exe 3004 identity_helper.exe 3452 msedge.exe 3452 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1636 1344 msedge.exe 84 PID 1344 wrote to memory of 1636 1344 msedge.exe 84 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 5080 1344 msedge.exe 85 PID 1344 wrote to memory of 1712 1344 msedge.exe 86 PID 1344 wrote to memory of 1712 1344 msedge.exe 86 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87 PID 1344 wrote to memory of 3100 1344 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1276990209430388839/1277216490260664381/blue_tools_2K24_2.zip?ex=66cc5c0c&is=66cb0a8c&hm=cfecc5683bab44f5f0516122af36a0d04084c2aa2c8311a0fe47e3e920f6ac38&1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda47182⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5280 /prefetch:82⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:12⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:5488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,4644873933390736968,14997448225532674820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:12⤵PID:5684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1232
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:964
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2844
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\blue tools 2K24 (2)\blue tools 2K24\start.bat1⤵PID:2612
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\blue tools 2K24 (2)\blue tools 2K24\index.js1⤵PID:5344
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\blue tools 2K24 (2)\blue tools 2K24\start.bat" "1⤵PID:2352
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\blue tools 2K24 (2)\blue tools 2K24\index.js"1⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
186B
MD5094ab275342c45551894b7940ae9ad0d
SHA12e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA256ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
SHA51219d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
-
Filesize
5KB
MD5ebbfed9f5366b01084b8c859e3f6aa84
SHA1d0614feb7d430dd4a58ddbd58947e8f71227b34a
SHA256775ffc991bfd1432cc4b04ac9c0623e4f33bf71d7f5624139929554efaf22886
SHA5126d7a3d7647212a4e98943aabbd137b89e484b6724a8247748dfcbe304ee43f69a1f15f89869050fbfd366ff170e2c858a2d01705f53dacb1532505ac4da4947f
-
Filesize
6KB
MD5e7e1ae9a67070deacdae2d8c2338c7eb
SHA1a9f002a989283707f98bc26d0fff29b8f9ca30f1
SHA2561f50264baf183be60396756dca2b39d2fccfee75437e27645555cb0332dc0a43
SHA512a70e51e343a6b28568198c9e0e2a00820ad8f1ce0294482732565063ddd06ddc9a92e1e789209a39a4c2b54957a2f8fb8f2803a7b79616f350b8e957d9e95dff
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD55a4c3abe9f3f4d46ecfd9a5d1a9de83a
SHA11d285bdd5a9e4cd13c1fc31494542691398ae30e
SHA2567fe12c2d5c3092d76213b5152ac31b10f4d8650b73628074df0ca94e14cac236
SHA512f1d3a5f653974e29b5770a67b25c6d35228cd8c0cbcb2a08e095e42a16c3fa8eae6a1a8c274cffe5e7136985438d397d60b64789215a88a7498c2f19bcdf17ea
-
Filesize
6.8MB
MD50d4ab575bfa7ec2d2228d150d7ce342c
SHA18d6f5add8535de3ea84ff0b639e5f08ebb41e0d4
SHA256c95a37422ecf3d6337a79ef7ac2834b1cfc64218ff38a5c591e7bb848ae64ffc
SHA512924a3f2acb5f4f0b47d1a9c453e02f9251b8a4d1f7abe984722c8c96287d1fcc6245cf8d7be26b0be235867354fd95ea26b70048ba8d44a7362bd1d7fdb8d8f6