Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 07:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mx.studenti.unpr.it
Resource
win10v2004-20240802-en
General
-
Target
http://mx.studenti.unpr.it
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 680 msedge.exe 680 msedge.exe 748 identity_helper.exe 748 identity_helper.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe 680 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 680 wrote to memory of 2744 680 msedge.exe 83 PID 680 wrote to memory of 2744 680 msedge.exe 83 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 3208 680 msedge.exe 84 PID 680 wrote to memory of 4600 680 msedge.exe 85 PID 680 wrote to memory of 4600 680 msedge.exe 85 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86 PID 680 wrote to memory of 4080 680 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mx.studenti.unpr.it1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b2447182⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12892253861850082701,3588452649123465290,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
211KB
MD5e7226392c938e4e604d2175eb9f43ca1
SHA12098293f39aa0bcdd62e718f9212d9062fa283ab
SHA256d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1
SHA51263a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD51bdd08ae1704a43cd56490f80cc4f7f6
SHA17e3ce75000847efaffcb25d6930ca3c1d451b264
SHA2569d314788165321f1287d64d3e77b38fefb541b3930b99428667dd606e866bacf
SHA51285d95082506c85a13ae7919e980c0b0fd551c4286070815532830cf6a693adb368504898ad0b32684140a5d4ea0220442fecc048c6b02f8a1000e0298fa16671
-
Filesize
1KB
MD579f3f7e68ebc91bc3f0a8c24d5a61223
SHA1b4e30c968776fba051ee048ed19bb2442786b626
SHA256ea352315da61b23e7af8986ef5f47176a0ebc07d75daa1e4f16d7c17440d44ec
SHA5127440ed649376eb65b8e1cc9b9815fb493f6235bd12f8945f64cae497f16d5e9e51999c76d13cba4a9ea6bbb5ed369af5bab0c4b517159d97f9abbbbf269b3c3f
-
Filesize
5KB
MD545dacd2a405fdb7c9b9c35ad54f9299f
SHA145a1bb2b5b10aea49ad5ceb4aff6aba14e350cc0
SHA2564b18f41e74a2f57794319f81e2d2a21bb95cc000de634184a67231e7622b17ce
SHA512818092e6a33b2b702b49a0724aa1467d5b6a3e47c4423020afe5c58d3b0bb167cdb8cbab3f23349f2dc9d61f43f4ff3ebe1c3028d2758012642531af9bf1b6b8
-
Filesize
6KB
MD57993a48aa8ea9acf095b96b44fd2c69a
SHA179a086fdc4f4e3b2442a8bbbd407dc335612898b
SHA256a946023fdff55297215db16b9bb3f2adc2dd4dc362e350870fda9cad67b9bf85
SHA5120b1e7b900b4eed80248f4bb03b9938c2c1ba29d701224cfaefcfdc820b682c4ce73d543ea7a6ae75ce81d8cc68a2bf77eee7f78d5988d781fd5842d4a7e490f7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5888b85c2092481967c9f81297ef7dfcb
SHA1690b6d02a0693f8524231d0db662b912c28e0c6f
SHA256e7f8bfa5b2851432290ae66b3fcdcfd270472e178216e222779cbfe91786d860
SHA5129e18d6b9969a14e659a06ec939a424e0b27445c9f6d128e2caadf920acc905168a61637f8f076845a3edfcb0281ec3956539c0311cc530bfca865339fb0f2d65