Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
9s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/10/2024, 16:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://privatesharesfund.com/portfolio/
Resource
win11-20241007-en
windows11-21h2-x64
7 signatures
300 seconds
General
-
Target
https://privatesharesfund.com/portfolio/
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 4180 3952 msedge.exe 77 PID 3952 wrote to memory of 4180 3952 msedge.exe 77 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 484 3952 msedge.exe 78 PID 3952 wrote to memory of 3124 3952 msedge.exe 79 PID 3952 wrote to memory of 3124 3952 msedge.exe 79 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80 PID 3952 wrote to memory of 2708 3952 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://privatesharesfund.com/portfolio/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fa103cb8,0x7ff8fa103cc8,0x7ff8fa103cd82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16249587189365908219,18240252941484087620,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:22⤵PID:484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,16249587189365908219,18240252941484087620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,16249587189365908219,18240252941484087620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16249587189365908219,18240252941484087620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16249587189365908219,18240252941484087620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:2100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2156
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5aad1d98ca9748cc4c31aa3b5abfe0fed
SHA132e8d4d9447b13bc00ec3eb15a88c55c29489495
SHA2562a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e
SHA512150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72
-
Filesize
152B
MD5cb557349d7af9d6754aed39b4ace5bee
SHA104de2ac30defbb36508a41872ddb475effe2d793
SHA256cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee
SHA512f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a
-
Filesize
6KB
MD5169a921572c1833ac0d2774e4e28a516
SHA12a3c25c78c9ac8a0521f751a7a9a7780a95732f5
SHA25630ca5ff8453ab4d376f385ba518e22cbf9f6fdaab1815b52a3d627e9af050cbc
SHA5127a30eb5a182f0faf34c27cd70f625817d53b99f13790d3663e1758ae247fb2372ff4db5cb516dedb0cacb492c4c34d725e41faaf15f8b69fbd7308270afadadf