Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 17:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://app.learn.hmhco.com/e/es?s=1145&e=3061119&elqTrackId=7bd6dc84ae0e4664b41bb0d6dc600416&elq=4072f0ac65724c7f9f7370d75b8c8817&elqaid=77123&elqat=1&elqak=8AF59E187789F2D0AF08A29BE0F7012FC5310F6A8B8A47558A32F407CC5A1AE5B0CD
Resource
win10v2004-20240802-en
General
-
Target
https://app.learn.hmhco.com/e/es?s=1145&e=3061119&elqTrackId=7bd6dc84ae0e4664b41bb0d6dc600416&elq=4072f0ac65724c7f9f7370d75b8c8817&elqaid=77123&elqat=1&elqak=8AF59E187789F2D0AF08A29BE0F7012FC5310F6A8B8A47558A32F407CC5A1AE5B0CD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2400 msedge.exe 2400 msedge.exe 1368 msedge.exe 1368 msedge.exe 1864 identity_helper.exe 1864 identity_helper.exe 2932 msedge.exe 2932 msedge.exe 2932 msedge.exe 2932 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 4916 1368 msedge.exe 83 PID 1368 wrote to memory of 4916 1368 msedge.exe 83 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 4768 1368 msedge.exe 84 PID 1368 wrote to memory of 2400 1368 msedge.exe 85 PID 1368 wrote to memory of 2400 1368 msedge.exe 85 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86 PID 1368 wrote to memory of 3944 1368 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.learn.hmhco.com/e/es?s=1145&e=3061119&elqTrackId=7bd6dc84ae0e4664b41bb0d6dc600416&elq=4072f0ac65724c7f9f7370d75b8c8817&elqaid=77123&elqat=1&elqak=8AF59E187789F2D0AF08A29BE0F7012FC5310F6A8B8A47558A32F407CC5A1AE5B0CD1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15f846f8,0x7ffd15f84708,0x7ffd15f847182⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:12⤵PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10769132008258759973,14207788207000643758,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
189B
MD523088ea04c02bcce80b89babd92dd88f
SHA16b51fce6c3c84d32ecb40faca40c9ef6d0d58f9e
SHA2566899abcde6c46ad9393a4dc1dfdae4bd69c44680c30b9a1229f602e46eb995fc
SHA5121dc51b4a68b88a9eab74e6586d5250be2712c9a4c3ed83d018c64dc5f4a90c2741cecc55714e3921b17e9dee9eb5a6ba5dec940d347a386d0cf57cf0157b1258
-
Filesize
6KB
MD570b486ae25fc4b93bb5dc00b5cce042d
SHA14b3d6641742dab2841a8e88d01cc30176820c653
SHA2561f28a5422d32154d1c2cb23e7d6ed7e069d55106f8c5a74df505f769add8320e
SHA512ecd31172e9069f48048cdabcab3d745638b8fcf71b3283a92082bdcf478fa1faaeeb54f94e63182f6a926244827ccf6bc867ba218f54263ca77e35e528045189
-
Filesize
6KB
MD57b5ebbc3a31d3e505c21070965a2e642
SHA1bfa9ca09c4d711cd371b42246963e369129468aa
SHA25633190b22fdea7376530730d6fbb3606f04afe1f0ba67f69d6fc23f703b8c7f01
SHA512d928e8598e9df3c8262733e602823f134ebbae2e76e0638e8c79a04f84e242a053563d4fe510d7a23916b29add174ed385d69c7727627a7818bed9afc05aff3e
-
Filesize
6KB
MD55d536975d6c3bfa9e6eaa543df9d5ef0
SHA148deeeb2f294512d3e81ea0eb516c4c15804189c
SHA25651a61f1865974d54df392926be0d8fe064b3d853f946821e101bcb870b8a2963
SHA5128f180c7d084497e67f83c2e1ae14fa2439e1a6def1d4d113b88f94a47756a503b0551eeedea49815efa3ef975413fe06741525f37c826216d16cfea68ed88d61
-
Filesize
5KB
MD51102befca7c63eb7ca6c7aa5c390d36e
SHA1e4318de5149a377f0c19476fbb4df757b4840116
SHA2569f0ba0ba3f5b6549566fbb78a72fa135fcdc31dc22121a8db23538c72d2d7370
SHA5128f7afccc940df6b78e00174ee435339a648895100a6dc12b7abd6f8db8a0b9bb3b66ddd130313b9e86cd602c87e67484a1c87fd6c7542b3fdf2aa811b613c766
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD548a81f9842d7835148259ab0bc943fdf
SHA174983d6ef1ee710e3ca2a3e024152e64009d6e79
SHA256190bd5884a4e9340d405a0c2e3186cf59e93b3514a307509560a7b0b4750cd4a
SHA51208be213f2d0ce18d73a2b59108852b46885dc1b57c5a10db730f550e8f7c3ed4abad1127c79f6eac651fc4cef08f5b83d9077c78a0b27123ff8696ce39ff9a67