Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/09/2024, 22:02
240903-1xxxzazarf 3Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 22:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/fj52uy1fteu59ao/dontopen!.apk/file
Resource
win10v2004-20240802-en
General
-
Target
https://www.mediafire.com/file/fj52uy1fteu59ao/dontopen!.apk/file
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2656 msedge.exe 2656 msedge.exe 612 msedge.exe 612 msedge.exe 3376 identity_helper.exe 3376 identity_helper.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 612 wrote to memory of 4580 612 msedge.exe 83 PID 612 wrote to memory of 4580 612 msedge.exe 83 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 4488 612 msedge.exe 84 PID 612 wrote to memory of 2656 612 msedge.exe 85 PID 612 wrote to memory of 2656 612 msedge.exe 85 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86 PID 612 wrote to memory of 2540 612 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/fj52uy1fteu59ao/dontopen!.apk/file1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f47182⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:82⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10415099736497172762,6167885491444000431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5eaab56770a55623cb4667fa31e8d6b82
SHA19f47cabce7b7a6eca8a45cf1ca423687b5d99209
SHA256270f47974710b259631e2c708c7fd3e2bfc6952701bad52c0f76f01cb39b0b5f
SHA512a5c884ef7e897fa6ba12b564604bbc639e243063aaca36ff1cbb14eb8664c3681c16db3aa7c0ac767f18f308fd8f6737d76f25ce8c3d683e8aeb1583506943eb
-
Filesize
4KB
MD58f8aec94590738e7155aaec97fc60298
SHA14bdaa3d131a3a92a99c24ec9b845d487777ea430
SHA256c14177d7d45d392d8497b4fefe7d30f8a819e7eacb18d708bded53e55f4f9882
SHA5124c35f9629c03b11364c33aaaa1faa918d59ee9a9917a0d8a5aed5ad1b7ac5fdb4ccc84024c755556faf13e55a3620dff9c2ebc3337936bcde0e4f30a2f3a9526
-
Filesize
8KB
MD5f8183cbe05bab561f15bb7d033dd2154
SHA1f53d30610ef63469ce580e295813cf2e176864d4
SHA2563876ee08a95e2c3358006ea1496382eed9ba8e7462644d23a774754a164368d6
SHA512b6ff5d0ab16bc7238af22265230c12afc61d6a4fb4c6088d6ac750e7c41bee55b9d8975eb97faec0b6dd0e2ed805953720b77a058b3b5d8fc37e54b389d3862d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6aba1e7-e0e1-4fa5-907a-4aac5ee75e07.tmp
Filesize5KB
MD54c7ced086fa0973a2d72e2631f4dfedf
SHA11fb104aaf4b6ab9b3a92bdb6bcd25dd3e0f1eb2e
SHA256bce8b6ea6291218e51b7249340b0ae74a154009771816305f0251b9d7ca08b3c
SHA5128c5521494f6020951ec480e81fcdf4dd69f14401c31a0ee46b48903044d6ec2704879c009644c41cc1a8fd3337b1337c632a1785fc7e1de05a60dacc362c8754
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD51bb1d5970d0579c97dc83409ba787ced
SHA156b3bf8a896987e9bf799a0a5630d58d05695d56
SHA2565f7288758fffa7e28e709c0e9f5edbe903d6691b16ceb008c912ce15b886eb27
SHA512ede75f7513e61b4bfabd814748b7062071147595aac170e710fd708e0210115e06c5ba7bbc0e59ca88d1eb30dc6b69eada9f68212a0543f24b0bbd528cb11337