Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/09/2024, 06:36
240915-hdbara1blk 6Analysis
-
max time kernel
22s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 06:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035
Resource
win10v2004-20240802-en
Errors
General
-
Target
https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 discord.com 6 discord.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "184" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{6471F678-3320-43E7-BE05-23D7C0CC2588} msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1584 msedge.exe 1584 msedge.exe 4560 msedge.exe 4560 msedge.exe 3500 identity_helper.exe 3500 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4044 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2528 1584 msedge.exe 83 PID 1584 wrote to memory of 2528 1584 msedge.exe 83 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 3636 1584 msedge.exe 84 PID 1584 wrote to memory of 1428 1584 msedge.exe 85 PID 1584 wrote to memory of 1428 1584 msedge.exe 85 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86 PID 1584 wrote to memory of 772 1584 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/1274902347180540035https://discord.com/channels/1190464114909253712/1191475296654864584/12749023471805400351⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa7b6546f8,0x7ffa7b654708,0x7ffa7b6547182⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4152 /prefetch:82⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5276 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5617319366914893320,18101611974311607318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5080
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3950855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
5KB
MD583023d26aac9cb77447cf8bd5ed81c77
SHA12968456536ff9b14acee1ce7df64836a47ad52af
SHA256cdc0ee966128d711a8a9c3d0054dc8c9afffe0149ddd233eac8e69cb8e7ab486
SHA512be893fbe39a717a29cc6632f101671e9fb60bfa00c5b9199eedb7f39b1e3363898f52fe03f9941f44f3a9940359e842214d4bcf9b62c97ce17495a9c8c3518bc
-
Filesize
6KB
MD57c2e3ebc41d0f246d3094e47dfe9ceec
SHA146a6a0be63590cfcf98f6a83d913e9cab55ecc86
SHA25634cbe48a9ded7663f66e2d3ff84f81430467442d7fb51b3d1d66d0b13447072b
SHA512b31bad759b191ce2a95ce770d57b5d5521f7040e4d55afe1733387b4c9567a01f15894ce8ea9aa2c056cd6989c66ac9f8ce9dfc0d1e4daf764b9e119bd175739
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55eea6dd923550e4610532e486405e5e2
SHA1ef35d9aee021f1ff834105f7340d8365d383bd34
SHA25667b8294aa9c9d745b563466e4b0d39c5d2ae6936d87d515172e42d094c7c96d0
SHA512e994a8709307407fc871934d34d2a963062b9b7aaf5aa2f023fab18e4e467139178ae7042ed998843073bb03a1a8c7fb42931587960a22d254ef0fe4a89d2a45
-
Filesize
10KB
MD5062eb55ba95b9fc559d315a13f43c148
SHA1f72b57c82e140e2a5772cfd65cfcb87a794dff0a
SHA2569326906a03d5569d1e7e696e21a87e8c6d41e6bdb91740d1905d3c912353105c
SHA512b445ead73d9105d0c4228e4288e60acbf7916508a8f47b1574004cedce16be072d60f0734c062c808295e229107b3937a56508f77f3c330e2fb1ace4980bf026