Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/10/2024, 16:40
241020-t6n8vszhmr 320/10/2024, 16:40
241020-t6jndazhmk 320/10/2024, 16:35
241020-t3l94azgjq 1019/10/2024, 23:15
241019-28pamsxapp 10Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/10/2024, 16:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://veruscheats.site/
Resource
win11-20241007-en
General
-
Target
https://veruscheats.site/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1736 msedge.exe 1736 msedge.exe 1124 msedge.exe 1124 msedge.exe 2520 msedge.exe 2520 msedge.exe 4732 identity_helper.exe 4732 identity_helper.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 4748 1124 msedge.exe 78 PID 1124 wrote to memory of 4748 1124 msedge.exe 78 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1512 1124 msedge.exe 79 PID 1124 wrote to memory of 1736 1124 msedge.exe 80 PID 1124 wrote to memory of 1736 1124 msedge.exe 80 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81 PID 1124 wrote to memory of 3672 1124 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://veruscheats.site/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3db23cb8,0x7ffc3db23cc8,0x7ffc3db23cd82⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5396 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,3647255457410347742,395158866507398021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:2868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7145ec3fa29a4f2df900d1418974538
SHA11368d579635ba1a53d7af0ed89bf0b001f149f9d
SHA256efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59
SHA5125bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91
-
Filesize
152B
MD5d91478312beae099b8ed57e547611ba2
SHA14b927559aedbde267a6193e3e480fb18e75c43d7
SHA256df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043
SHA5124086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5137276a5af805df972166162f996dc5c
SHA1d745903034bf856f6c8a1b41636e57574e60f2ff
SHA256e4f83f6289ec7197070f911092379759f86ff980bf49a552d7b4c50b026f5406
SHA51242ca366fa424370d176ca056299229185b110329a0cbad1639ed388ff831e73861aa53befae6519fc3069db3bf0da1ac9eec4a2e9c789ace2649c1bed1b610ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5511ad120ea4e9d3807c0a1e5d07de75a
SHA17c4f0f0e6eb3185bfcd90f74348b109e5f92ab94
SHA256fc2532ccb708e1e791a64c1c355ddd9c57f1644b56eaacd4d1b623e3460f3b76
SHA512555c5b618bdb664523b525d3992a29d1c3aa71f58e651f287a7d474bb2faed93d92d548b73e8513fd2f06047223c70ee30aca7375e53fde379df8faee50eeb9c
-
Filesize
557B
MD5683fed5bd6fe4eb2a991a19e7c28c19d
SHA1d6f0c461a1a399338c629afe2c7537152f6e2d72
SHA256a2a164209a65c659615f0a2d357cdcfff54a1f81f6b3d0516123fb6c6b10d865
SHA512702875c3c7b9e88403b1dfbf5f99bd5adc0811a0ca83ae971d632dd4a6c4e27a13330be78903a5cd9333034d3b3882ec4737106fd1c83f29f7c13f55ef0504b7
-
Filesize
5KB
MD5b41ec67454ca3353563a76566609deb7
SHA1a72557a064a8ac716ac3453688390a6b986307ee
SHA2567f1173c9e48227b682541bb64110631486d9bcf67dceefcd960a5d3643bc46ca
SHA5120c282b7a5436f54b1f4bd9707002cb814fde9f2d96e369d7155a493bb499a08e46ba86d505b492e896c91950fee76f55f5588eeba3384fc3e30235633dfdc270
-
Filesize
6KB
MD5940492a95448dec9539a0e1a34d5a85f
SHA15a5873f7a381c28ef9f05dc79455ddd715e3b0b6
SHA25690143a543fb962fcfac7b84b31518d51d6a141817f829c783a7dc8f55508d932
SHA51233f17e3176272481a599f407b2787f163c7a071ea38610577715c9cef00f56e352a249bbf505017d6c4726ec3f6a0f1d102b7496ac5069103cf1dadec63c8282
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5fe8de3e26293a4485d78e56c8015e9af
SHA1e99f25da96a30ac9ca0faf527a15db9f9fcac7bd
SHA256273d447c06516a6e1d692395ff17dbaad2e149a6798ec2f70b0c8ba42ee0b379
SHA51248f6539c8b79f1bbb5d51a2e0fa5a69fb5cfb37c538ddf7f7488bbc1cd12d757aef10ce6755a03b922cb02caf576ad1e087ffe87a28be5883187c5f632bae940