Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:41
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://messaging.folders.best/[email protected]
Resource
win10v2004-20240802-en
General
-
Target
https://messaging.folders.best/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1688 msedge.exe 1688 msedge.exe 3048 msedge.exe 3048 msedge.exe 1472 identity_helper.exe 1472 identity_helper.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 4760 3048 msedge.exe 82 PID 3048 wrote to memory of 4760 3048 msedge.exe 82 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 620 3048 msedge.exe 83 PID 3048 wrote to memory of 1688 3048 msedge.exe 84 PID 3048 wrote to memory of 1688 3048 msedge.exe 84 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85 PID 3048 wrote to memory of 4924 3048 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://messaging.folders.best/[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8234d46f8,0x7ff8234d4708,0x7ff8234d47182⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3326038743420345236,799232257672699089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d4829218222c8bedb9ffe89dffd37095
SHA1aae577f33f413ec3d09f2e7ff5d9cc20a602241c
SHA25649239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b
SHA51203e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1
-
Filesize
152B
MD515e9c4b4eefb3e1c08a010e748e10f58
SHA13172378f2c7a00553ce086dbf53fcf3126c5a724
SHA25607b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000
SHA512811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e
-
Filesize
480B
MD5a5b212baadd79c67fceee13bb48bab5d
SHA1af309063a9035f4ab5f8f15f37aa8bb0b8e8472b
SHA25633f0c6a27f942d79c00559eb92691b78cc0472e59f3471bfefd193e3978eb647
SHA5124fb9542c94e92022bd5073fccaebffbb1e7da0c8dca169f2c4c765badef73d27ad168353fcbf650ddf902b016673cb95f54cd2addf390196d539cacd793d85e4
-
Filesize
5KB
MD575762765721c9fd28d22859144406fca
SHA18b768eaac30ca3441b278dd07a84d0b0f1ad3d67
SHA256b0a26c0bb3c5c588e2d22769caf57dce3cfaa1dc7266eb164307bf28d3ba2e3a
SHA5124a3593686c67b88b733c4ec0d64e10a3feb1c46d10368461987742980a18e3a05ddf0219bb45bd32061f9437bab6a1961cb0688358217b6f15639493a6b6b079
-
Filesize
5KB
MD56e111aaefc9322cdccbbf45d184d0e19
SHA1b00d1d16e2cf6a8384ac7dd766ee335e7978361d
SHA25677d4bdf1bca655e2869668779fe78f044bd4c0550e04ec74c4073ba23938dc22
SHA5125865077c75ec75b5be10b93f7653eead1667f7cac406836d0bb3d24c9098c6908205347d5c6a2f81902361db3ad903e33a3d76da4021c4de0956669942ec6573
-
Filesize
24KB
MD57915ba0545666aa5833cf9f9f86d45d6
SHA1743ecc319bc2a54973582d4a5198042a48fbe8db
SHA256f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20
SHA512a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f102b1f0489827ce9408120f853e74cf
SHA1e92eb41d542e129b65166c9892df32367c58c8d9
SHA256bb276b23fc476948e6def4546e6b827661efdc0ef8f004a5c92b132ee2d33fdb
SHA512694addd44e2f380c3bc6b5894eae17f18f480e13a8c3050f7822c9d9bcaf4a219ebfcc9214bcd6f86390d9372807bd7b97c6ddaa4cdcb6583cc2c6c2f536cdcc