Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
485s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/09/2024, 15:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.roblox.com.hn/generator/BeamingSoFuckingEasy!/
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
https://www.roblox.com.hn/generator/BeamingSoFuckingEasy!/
Resource
android-33-x64-arm64-20240624-en
General
-
Target
https://www.roblox.com.hn/generator/BeamingSoFuckingEasy!/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1308 msedge.exe 1308 msedge.exe 3396 msedge.exe 3396 msedge.exe 3188 msedge.exe 3188 msedge.exe 2388 identity_helper.exe 2388 identity_helper.exe 2296 msedge.exe 2296 msedge.exe 2296 msedge.exe 2296 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4752 3396 msedge.exe 79 PID 3396 wrote to memory of 4752 3396 msedge.exe 79 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 3028 3396 msedge.exe 80 PID 3396 wrote to memory of 1308 3396 msedge.exe 81 PID 3396 wrote to memory of 1308 3396 msedge.exe 81 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82 PID 3396 wrote to memory of 3116 3396 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.hn/generator/BeamingSoFuckingEasy!/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ffd6bbd3cb8,0x7ffd6bbd3cc8,0x7ffd6bbd3cd82⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,17770738575861714975,11288313336245305901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5026e0c65239e15ba609a874aeac2dc33
SHA1a75e1622bc647ab73ab3bb2809872c2730dcf2df
SHA256593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292
SHA5129fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569
-
Filesize
152B
MD5228fefc98d7fb5b4e27c6abab1de7207
SHA1ada493791316e154a906ec2c83c412adf3a7061a
SHA256448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2
SHA512fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD59c828ca1fb372a45bfcec237dc3113f0
SHA1b06061910c3f115082abcb75877d54a288961db7
SHA256dc9a223f6d7f5ff2cd912f9eb5428e5be5041dde2b4e8f03ecdc0218cd1451a0
SHA5121bd3814db02645a19d30b7b6c5d90ccf3abb9cb4a195247daa64683f465288d4929deacffd02cceab3a58d6a1b1ff8d89324401992435ff5555b040d6f1cc08c
-
Filesize
689B
MD51740b6d4a97929f4706690a09bc8adde
SHA18da7f22126d64bd41d72e8347071fa32045328cf
SHA256d4e992a1375be321b467c279fa691d56766868a0827ba8125f4736acd139a315
SHA5128627d8ac7b6a5897e5642ccd9376a5d379c2bd995ae5eb4afdbc9b4422759d9b92b2f93857332e02023721ecbf9d9d294d426155d859a214e18d60616aeb8082
-
Filesize
6KB
MD5535212318f56d29fbc538eed08a2e666
SHA1cd7b4eb16d2a1be5fe63e65e1dfbd1a9a806a9d2
SHA2560df05880785e592e4f826f9b4644e7dd129dc63d2fba13916e552d13d36f1d3b
SHA5121fa75c6c2f2e88c3954fffc9bd2a25f0b8e76a52f6c15ef0ac5a2fffbcafbd02139807c53cfb3866ce1dfc5b7005f27c3493a5fccf90414907e6ac737b8c7853
-
Filesize
1KB
MD5788290d6ed8897cbf75f50cafe426337
SHA19836216a420945a7f807849fb3ed165ae9f81808
SHA25629bd4548e3391daef7f59f7816c000510721e83fcc5cf977c0c620025ee6689d
SHA512555901d132aa54efbd88f1a51e99dbe08970f7c97d539394722a5b1b8748846edecd7efbbbf69348b1128403e8f3be7e1daa48df78630025f8b9598078c2d1e2
-
Filesize
1KB
MD519a555fcf9c917722ec1af6ce6a65050
SHA17382c4ca0d677726c1775e0ec42170cfe2ceaa1c
SHA25676fa23915fa94a9f51404eade0301aca5c46474e79baa27a5a856e068ed2653b
SHA512834161265eab368cd7c6f61b6600927fa00ae6bcbb6aa66833ba5e1742c2665ba16df444bfe7def42da795ee6889fd0db8f1a6aa0b37b8c4a6c3e04b4402ca8e
-
Filesize
1KB
MD520c052ae90480913c356b0aa0e88e08d
SHA12317edc557222d61880ff9e9f20d56c12f8f1218
SHA2560bdfd6b9ab287e6d6935f169eab7c236c7253604bb6fc3e5a5e1951c8fe20b84
SHA512482c12325ad392269d8227a7c616aaf76708b3fdf7a0450d83230262b11198ef8eee5fc243b07007586db4c6f1f00dcda8e82e956fde113435dd7a18fa0e394a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c17d1586-fab1-4996-bde9-79d149243910.tmp
Filesize1KB
MD5e0e5c995602121914f7f2ae4fc2fb234
SHA1fc8f789b653e903e7ef033ba046348b4139ebef6
SHA256aeeef20c9ba5f9831244bd327489c0b576d55d34309f4e9050cf4f3428c016dd
SHA512026a2b06e6a04b4f31b0d18c8c4c6210ea6feb61290c499855cc1b86552fdb52c4e8d7f6d49c1378ccb2765a08244ac8910192b1b0555a1900cab28d2c95b2be
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e22c39c0-7ba8-4fb6-91b9-3366e519f684.tmp
Filesize5KB
MD5db75d60daf7de2d597f05617333ef602
SHA15ebe740571829614e3779d84863ea7852320b213
SHA256783a35d6cb65d7bc215b9e15a56086e2d5697fea4844bd521613b95952428552
SHA5125b0527321d49002325b4134a54cb49409ed8b30440917d5d2b9d17eaee9661d7c3161703cbb4f797fd03f43e0e2e088c6557571cec6f606a6bec1bb1a4b13c4b
-
Filesize
10KB
MD57995ca9faf73e6f99ec123bcc6cb887d
SHA1fc6d4fecb9f0adfd8f1389604bcd96f7dc273174
SHA256f04f6ed938b469623b4af0fde3c267f573354e6d630f7983cb60370f466e8342
SHA512d68d76096d49d51cf65c234f5a8036694e71ce831884a70aee19bcc6e4cdadf5ef9492399360fb73a49561f8af37102aef7bfdcb647736fda080eae45f433161
-
Filesize
10KB
MD5dbce063a36259763494f3d34d73b96a6
SHA1f8649441376b58a8298d010d4e6246174afeaeaf
SHA25688a1851e97fed546c40d6815141ed395702e29478233b23e6158ed7800dcff47
SHA512e7b624f7d16fa776b402b4dc0d7f1cce1b6b56627f435330d740c319d1b6637753237ff6a2c1dd027d7c946cd293ec9dfa044648d507fa2a32a1187e960bb588