Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 21:23
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bafybeicp3c4bdmhxd7pk63idy5pnwgcf7bh33evnk53qzu3jaxcpr4xc3i.ipfs.dweb.link/cPweb.html*[email protected]
Resource
win10v2004-20240910-en
General
-
Target
https://bafybeicp3c4bdmhxd7pk63idy5pnwgcf7bh33evnk53qzu3jaxcpr4xc3i.ipfs.dweb.link/cPweb.html*[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2788 msedge.exe 2788 msedge.exe 5036 msedge.exe 5036 msedge.exe 3248 identity_helper.exe 3248 identity_helper.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5036 wrote to memory of 3812 5036 msedge.exe 85 PID 5036 wrote to memory of 3812 5036 msedge.exe 85 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 4548 5036 msedge.exe 86 PID 5036 wrote to memory of 2788 5036 msedge.exe 87 PID 5036 wrote to memory of 2788 5036 msedge.exe 87 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88 PID 5036 wrote to memory of 4468 5036 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bafybeicp3c4bdmhxd7pk63idy5pnwgcf7bh33evnk53qzu3jaxcpr4xc3i.ipfs.dweb.link/cPweb.html*[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9b3f46f8,0x7ffe9b3f4708,0x7ffe9b3f47182⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14423258142046471778,7487195935452180984,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4164
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db1ed3bbcaa8e96c29a0b57e72bf0319
SHA19bc11860837a2bcdd048613ba8dd76d6d77d32d9
SHA2567c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c
SHA512eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8
-
Filesize
152B
MD5b4b5eaf7edd9d5391ddfdb694e0cd888
SHA1d1f92fbd238c4d5fb6861a83153893568d514586
SHA2561d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903
SHA5121b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD527249534f6dfd5c25565590759c40f90
SHA1f7f92d4bae3491bfc26096eb9945886cf3cdce0c
SHA2562aae0a4c3a08761d5d5b8837d1fbb325e6e28c571bc492b8ffa7d8e6bf577ca3
SHA51248b2b8f240969e80fdaa78571c0528ec786f26c9f340bf3ec2c2e7a2233ed771e77c88e8e3ad6a1b403effb37fef8de864fba47ef2edb27c7b4462bf095c5875
-
Filesize
242B
MD5489ba514a11887f780788ced75b8717c
SHA1652fbe26ebe4ecf4857c99ebe8126b0950f244af
SHA256b8635e6b013fc96381fa7ce46f49a7a134f76d0bb9358b4297d916d866a1a3b4
SHA5122e098b3a79f0efc2c65b9c23e83966871eca30e031ea0486dbb9f4230a416c95d2bc917f59927fca7925bd3282c83e16914809553f1e2e3422cd2e554b1a2a7c
-
Filesize
5KB
MD518fa866e7a65f8ce4b34aa6ea9a8f649
SHA10e084b46966445b3cc0804b8aff3680f38e57a05
SHA2568cbc537f17e259b21bf213833a4d97e6d3a590eeb1ac03a4edd9098424607d05
SHA51206695107ec1a1e64df3d9a3efcabdc106524a8635b6be49dc1196fcda1e052270e2169b64aa936fadb78d60a5eaf2fa1a0334f079a1884c68ebd6c944acb69ba
-
Filesize
5KB
MD5a639d81dbfb6608b135d2aae64e5ac5c
SHA13f2fd4ff5868f438cebfad45c103b3ac5233293c
SHA256f8c021cab9e9c61217a6ce4a28afdcc3b77a6dfc4f86a96c8bbd6f1fcb36dbec
SHA512f15749adb9af38014be551df083fde344c01507c3a8499430e4b5dedefea70565064b58737a31013c4ccdedd3eeaa0ae33147ca993ffbbc232b663615bb25339
-
Filesize
24KB
MD5941ea4c983b3cf877ce6e1aab38f2794
SHA1c4fcce581d0660a0c96d0579aedb528a8168233c
SHA2563d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342
SHA512f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD52e7f156c4ad642d386127cf3581d984d
SHA1e25f77b155d5e428187c4dcb703917471b75be89
SHA2568d947a78a982157105cc082e18ea07d5a3eb070c4bb102e95dec7fd613247937
SHA5129dccf26c66c33908a20d3930abd27a671081138f989eee4c54d745aeecb6646286e8c7e2c26e2ebba0c8bff1dc6fe8a908a73f6d75789565a42bf5c2705b78f8