Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
960s -
max time network
965s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 18:01
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3968 msedge.exe 3968 msedge.exe 2472 msedge.exe 2472 msedge.exe 4112 identity_helper.exe 4112 identity_helper.exe 1292 msedge.exe 1292 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2516 2472 msedge.exe 83 PID 2472 wrote to memory of 2516 2472 msedge.exe 83 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3388 2472 msedge.exe 84 PID 2472 wrote to memory of 3968 2472 msedge.exe 85 PID 2472 wrote to memory of 3968 2472 msedge.exe 85 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86 PID 2472 wrote to memory of 3572 2472 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gist.github.com/jtrent238/391b096089eb2461714e0cf41b1cf7b6/archive/de69c82bd3d5a715e102e54c5bc6c865ea8448a0.zip1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c47182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:82⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6384832606855934337,14282768668309408614,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2496
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2228
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\FREE 50K+ ROBUX CODE.js"1⤵PID:4036
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\FREE 50K+ ROBUX CODE.js"1⤵PID:3940
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\FREE 50K+ ROBUX CODE.js"1⤵PID:3800
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\391b096089eb2461714e0cf41b1cf7b6-de69c82bd3d5a715e102e54c5bc6c865ea8448a0\FREE 50K+ ROBUX CODE.js"1⤵PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
260B
MD5763a099085dcb9a3e114a0da49431542
SHA1dbbc60f0d5cd69b992dbfe09f7a602b280d190fe
SHA2565830548d3e5b37eab1ef91297b46f5eb7176b997f71be32f6e5a1b42bafc88cc
SHA51203e72d3157656f6c25cd9cd8f557df27beb8bc45cf5beeb667172c7ee3ed39b10ba565fad83762a5170ee2d4f52f660a71dc032adc22fa57e5ee907446c784d2
-
Filesize
6KB
MD536ce21be473d893aefe566dad2704161
SHA162058ba6cf012ca4e68893377064772140511e3e
SHA256079765241209e695dbe8d0c72b84ece95ed72e2817b828089740cff2c2ec7038
SHA512ce66c1fe776843e962a2302dad607429851b27daefdc8037dc4ca09202d5ed9ca43e99f381682900cea8d06cc7658883bd8037effa3cabd516405aa346f15c1a
-
Filesize
5KB
MD555ed4ccd2786a65d6ee833bd2c30a586
SHA19bfd074ff7668c8cda8fe7dbfd16bb01db7c60d5
SHA256d70b0f2181628aa74e5f1cf95bf3e4b7d8b9764128f333cc6a8df178d1e111f9
SHA5127120fc5e9a913a693f99cfad739fca9bd27312ffbf2635d4ec254975e60f531a18f9fc952e611fc96e27a4dd9fc674e115961aae57c25360f05d084d88266282
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD542d09663f2b217db098803092eebf104
SHA1f95eba313300e09208dd71a97582bc3f3892f258
SHA25631ccfae31c71c12543242cdaf4645f843cfdd1bbc0d5e529301956ea23186862
SHA512dbb5f7a30b64485fe950296010b2ef4761cf472aab198eb8a652918a36f1261a81bedb5a509f18c4a02d98aee046651cf0e1c1a63c653621491dada6a6c34a42