Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 03:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://alphemycapital-claim.linkdrop.io
Resource
win10v2004-20240802-en
General
-
Target
http://alphemycapital-claim.linkdrop.io
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4156 msedge.exe 4156 msedge.exe 4632 msedge.exe 4632 msedge.exe 4732 identity_helper.exe 4732 identity_helper.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 3592 4632 msedge.exe 82 PID 4632 wrote to memory of 3592 4632 msedge.exe 82 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4932 4632 msedge.exe 83 PID 4632 wrote to memory of 4156 4632 msedge.exe 84 PID 4632 wrote to memory of 4156 4632 msedge.exe 84 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85 PID 4632 wrote to memory of 4264 4632 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://alphemycapital-claim.linkdrop.io1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce3446f8,0x7ffdce344708,0x7ffdce3447182⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 /prefetch:82⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7390687461288058999,5556806529137176212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD52f29cf555e95e5738e024e2c5677e893
SHA1999eb4f6909442cf2f26ffd52b14c5e1ae92a0b7
SHA256ff1ed21764dd11f327b8e9e9a157f1d2c3e478fc24e65cd2ac8009e22c5825ca
SHA512339cedd3eace17e34c0723d29b9ebac7f78b60b18ec0a0ddcd22ae3e3d216e4e5208bf2673811f372b2d479e97fe1599e09ec30dac741cb38662b4160ee981bc
-
Filesize
1KB
MD5b924af4d01ccc34d5223cc023e375074
SHA1dfc932c2253163434c2ddd1d394ae053677cb8ae
SHA256caff763b00b6b6e50d1a3a7fa444958757d8a55d1e3517d74507e6a268746d4e
SHA512f5907f233941f3c003acc53f36b3091fbeabe7d7872794dcf1a2508835a938f2de62573baf68893331abd63479d49283f69bb2a925681b72be7a90d5ae5f9897
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5e21ec3f4cf76186ea050a29ab662e7b5
SHA17aa1a4a70a8cc7cdc8a5b5d75c96c1cdd1d4e1c4
SHA256772e83d13a595d5c04259c093317b2fbd7ea46a7b7a584d2697a72b22aa44f88
SHA5123866c07fa11397f868efd04955531a64bb2b5b449e63f38551beb9bdf00a587b49df61e4a8c35e2e8a1e1489c30879ebb662b415e016fcfa7bfc64757b31cb20
-
Filesize
5KB
MD54a64159e31d145fd13189776fe1f7127
SHA1a8d95f57b9cee350442fda7bba7a07a22a42bbac
SHA256a76947643d00db179b5c86229b721bdc08900fe8996100a29e04732f58cb3df0
SHA512e1f11fd5fad850b58aa6351fe3627cf3be51f62dbbe7ccda67351e0f610970b4e791a2c41149ebe85640e19bbe4775bd0c920437e6c766587cdbb10928e5ac52
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ce6dbc2fa99a8e53a20949d05e81ed11
SHA1a063dc49e9dd70f99873c64bb765e6bd9f546a75
SHA256b2e9eda0b2061abd4a4a4c93b2f93d3a576b74698c44caa5841859908a2e01b0
SHA51273bf3f958e864879c3ace422b18e9c585e5a1a11fcdac9ac7982c3d1c49fa217aa7204ea461aa784cf2f3007a86b7af2753a7cbd982a38bd942c2b3d6a36c760