Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1794s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 17:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/12bFfYO2xPsPBjAH0ybublVVnJP2dv4ti/view?usp=sharing
Resource
win10v2004-20240802-en
General
-
Target
https://drive.google.com/file/d/12bFfYO2xPsPBjAH0ybublVVnJP2dv4ti/view?usp=sharing
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 7 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 540 msedge.exe 540 msedge.exe 972 msedge.exe 972 msedge.exe 392 identity_helper.exe 392 identity_helper.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 3668 972 msedge.exe 83 PID 972 wrote to memory of 3668 972 msedge.exe 83 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 2428 972 msedge.exe 84 PID 972 wrote to memory of 540 972 msedge.exe 85 PID 972 wrote to memory of 540 972 msedge.exe 85 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86 PID 972 wrote to memory of 4428 972 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/12bFfYO2xPsPBjAH0ybublVVnJP2dv4ti/view?usp=sharing1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc437c46f8,0x7ffc437c4708,0x7ffc437c47182⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1230482469031659845,7389421265909827843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
1KB
MD527d9dc8a9eb62a5b77bef2f7d56589ff
SHA1b027747d2f1e4b5b1ba91d6feec6bdb6233cd6f8
SHA2560756c9a9e96188dd45a1def7306ad9a34debcc4d6823d607c41e4fae82fbfd1d
SHA512bdbc87f3b54a376873abf82cddef0c6a1e5cbea8c41c20a4d8d3cb0f6186cf771afe170152414f67a3530bd9a6f9e6412771fade5c611694de3f779627a40ddb
-
Filesize
6KB
MD509b8856b68ae01dc9f28df55600f6156
SHA1d0cc98481cabc767dd801af06e836649150739b1
SHA256fdb1b8c8448cd1ff8275629165e33e4b58768458442c4a857a77bec794e6d755
SHA5124ea52e3eaa597a54782c0fb66295e32d5c86a4a7027e7675311295b4c89c34f4aab78e3c4da3d9bb49c7162c1f76fea461f5ae381b493fcdac7d6f22ccc56050
-
Filesize
5KB
MD51895b6d4fad40d8cb61611371857dce3
SHA1da49a8e4c80efdddc827a486a8c786141fd1fb50
SHA256b79ac2291b1f054b6a57c775e2d765ae5e2c3ea3f6016b3c603891a5be1a64d6
SHA512f2ab8acdb1f824d6bfbadd260b03a8ba436fcbed9b9f7be0d54e5ec35141d9e3d3332364bafbd3ce74922d70847de04b9943380011fdb47eb630b002797fc033
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d5b7fad7f66f7b28ae7e318328f120ce
SHA179aa5c04a27ffb669cd92b84f08a76901f3aed7b
SHA256e4fd6747217b6a327861fde994f0bab913092019b04fd8db8ab433856d6d4979
SHA512663a96a871db0a120410464e3070ed1733987e2d0d0ffe3f6bd3b34aa1e6c1ec2b34363408f3693de664dbf535e8c97786addc53001e6285eec7f3ed4e20da66