Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/10/2024, 21:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vedaliving-my.sharepoint.com/:o:/g/personal/kari_vedasl_com/Ehhhu2O6ZGxEr2mDCtZaeh0BsN-R7_XzoAeh8PKTIlNd9Q?e=5%3aY2p4sM&at=9
Resource
win11-20241007-en
General
-
Target
https://vedaliving-my.sharepoint.com/:o:/g/personal/kari_vedasl_com/Ehhhu2O6ZGxEr2mDCtZaeh0BsN-R7_XzoAeh8PKTIlNd9Q?e=5%3aY2p4sM&at=9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1452 msedge.exe 1452 msedge.exe 4492 identity_helper.exe 4492 identity_helper.exe 4672 msedge.exe 4672 msedge.exe 2204 msedge.exe 2204 msedge.exe 2204 msedge.exe 2204 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1452 wrote to memory of 3340 1452 msedge.exe 77 PID 1452 wrote to memory of 3340 1452 msedge.exe 77 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 5012 1452 msedge.exe 78 PID 1452 wrote to memory of 1724 1452 msedge.exe 79 PID 1452 wrote to memory of 1724 1452 msedge.exe 79 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80 PID 1452 wrote to memory of 4572 1452 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vedaliving-my.sharepoint.com/:o:/g/personal/kari_vedasl_com/Ehhhu2O6ZGxEr2mDCtZaeh0BsN-R7_XzoAeh8PKTIlNd9Q?e=5%3aY2p4sM&at=91⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e3da3cb8,0x7ff9e3da3cc8,0x7ff9e3da3cd82⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:22⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,11068019745664356694,8447238960643368194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2608 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e9a2c784e6d797d91d4b8612e14d51bd
SHA125e2b07c396ee82e4404af09424f747fc05f04c2
SHA25618ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6
SHA512fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1
-
Filesize
152B
MD51fc959921446fa3ab5813f75ca4d0235
SHA10aeef3ba7ba2aa1f725fca09432d384b06995e2a
SHA2561b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c
SHA512899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5ad1be4c662cf998928fed805ff400bbd
SHA111b401422e81e86ca9f04291926980f6e4dfd48b
SHA256d4923bf7e513b05d179f1296b4586534352f48c5126df8afd7372d2e3b591a0f
SHA5124dd88934a18a1f17a42553b4d45384b842872d8decc2193dcab4f48bae36778abb2001606629326e32754261e1b3713690c44422dd745dabca8067fc036beae9
-
Filesize
362B
MD5ce87b659edfa32558e4d8fb35cec0426
SHA110d6e91d9f6e2046afcf0f310b23aa8a1a17a99a
SHA256dc55da3b635b014db7800c66dfe669cd10f2be120bbfb3cbb6a44c9d2f7576cb
SHA512a931b4ace8d8fcc89782c4f8168bb53fbee6e9190a9bad83904ee95081bccf45c4399de5e5c99387648686206e6d722681d8099b0485cb334e45792e20ec0081
-
Filesize
5KB
MD5746915deda0f5f715a1d12e6671d0d29
SHA1d841fb02e178f9b9f72e5f61db3bd1f128a74e43
SHA2569bc0ea5a5b20be9fafa1bdf38aa47f9385ef6b8abaee1ab491666e9f5f312ac2
SHA5125603f6ff76c398b05a51172d3742b5083530779c5dda87f69eae8246848393c17aa82e4899c38a03577de685668bf8f38bf6ace9251a89d7465720f62b587e62
-
Filesize
6KB
MD5be41a176782367bbe6590b431d9c8038
SHA127c599428488b77f9fdec6aae18eb44e160844d5
SHA2561eed52644d66791066fed033353bfd09ce204ce7f17daaff7b0be93d6aa06845
SHA512cadf8886102edef95cad692ec40dcc2e8088b73cae1b26c50ed01f0c53b5a551d8567f7e8986d08755cbfdc8943f0b7e20b730696075ada1ed04b4ca412ae251
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5266b03ea926765c0b901d78c2d2eaeec
SHA1bc1385c4bebccbe637eff75f2bfeaa2916db8c48
SHA256200ce03640ad74991be26e6bb668d52f944a71e68ea4a4b8c2de30c064453a5d
SHA512bb24b0542cc5d2e34854bed1ad814b0fda8fba485cb649cad22118214caec4549d427611d286b7d7527d921ae682d8fd2755e17cbe36555f788933ccf2b8154c
-
Filesize
11KB
MD585c998ef648733b079c64f9bc93523a3
SHA148467acee75b89cf98db9a05e47f89c832558737
SHA256f7f5fad9784f9e51759d9a4a96498aba4e80397848d2adeaf55da8d8526a5f3b
SHA512625ddf4e50f91e5148204fdf187124ac20e9ef4688a1b10bb59c12b55a6aa9f2aa7a895523566444ad9d70a93206853120ae2d30ae8a515073ef0f2843a54317