Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 09:09
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2916 msedge.exe 2916 msedge.exe 2660 msedge.exe 2660 msedge.exe 4700 identity_helper.exe 4700 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe 2660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3532 2660 msedge.exe 83 PID 2660 wrote to memory of 3532 2660 msedge.exe 83 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 60 2660 msedge.exe 84 PID 2660 wrote to memory of 2916 2660 msedge.exe 85 PID 2660 wrote to memory of 2916 2660 msedge.exe 85 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86 PID 2660 wrote to memory of 2388 2660 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://safrareal.com.br/yoya/v40xkxvchmuwrr0rvtfwek2sltriwjqgpmez7/Y2JlcmdlckBleGNlbGxpdW0tc2VydmljZXMubHU=$1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa803c46f8,0x7ffa803c4708,0x7ffa803c47182⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:60
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4686879649230434379,3226363794465412130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD52ac42162d91c37153a06f5061a7792fa
SHA1a6e387b0c5d0beccf78c41fa4f8a52591a2fd82a
SHA2566da01aa8202e0f84a519e4e30fdd70d2c512d28ea2ba73f02abda30c8e3e2c7a
SHA512290091d0f88cb95e87289d2b2253e48bd2d746e11a143efd748dc6e7c67f63f922efba7cf09ff7a57a210ae2456fc54df260bc633a26bc17f29b1bdcd5273ed1
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD52cc052e692968c9d6677910bb80d5584
SHA182338eafd7790763540c3fe9ed8d043f8f7a6855
SHA25645248c81727b7baff829d1f5e78cec794d3e8374e96489c888d253e046370363
SHA512602f9d6827f54b062cc7ea0ff3208e1966fadb2e9fca5b65aefde7c7f0751af19d06adb0f721e84127a27305576ae53877c9c428203d0e1cda5a2bd220b222eb
-
Filesize
6KB
MD5f9819dadcd0977ce90d2ce348a601b53
SHA1327b9a18ccabfb597a4ba10331ffe51b9c94aa15
SHA256ab1ece94422500f76a864752905ccb2f7c6e58aa6c4c3cf7834cb73c46eb9ef7
SHA5129f4973ce0fd47c160de13e4568323231c9dd4c494e1340288488ffd4d07544d82e68cb3e8664927d4b86574a57def94f4ffa0b06a3528df981336f4c7d8cc62c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD581f956c0c784688ff5dc70886b401d3d
SHA103b6ef92b045a68a6bca2ee3e7f6cc9f58a756d0
SHA25697547c4eaf2c7743fa9c61109d7f25eb3c8269c2b041a605ec9f6235f1238928
SHA512475558cb4f403232372a9132456e1afaa5eec4d780214aed9810280241f1eb37558eb20d6a87aa7a958fa9b6585efee89cf66caa314cd4d8257d9afdcf788355