Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2024, 17:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.paypal.com/myaccount/transfer/claim-money?context_data=2MarzaigiwC_KJjlGv_dzeActjo94BeuG8qyyBQgIdZgQLpao2H5LFD0tIgSMcO8hFYZ4fxI6vV4pMGxZVAtxhicMV9gq3ewLGfuCMtocM4VXh8gJ1QVhudP4j8KejvTuYPGOa1nhSYRNBh_Ojp9HZx7yVL5waiAXQ2NlCFE0HssMzKIJ_3Vg7slrbKcrYPOJDVheDhOTXix4BRzIJQAJIp4JnYJ8PlSWJN2qzDLSf6V-ybPDNMAsNeMOnO1GBC062ikrG
Resource
win10v2004-20241007-en
General
-
Target
https://www.paypal.com/myaccount/transfer/claim-money?context_data=2MarzaigiwC_KJjlGv_dzeActjo94BeuG8qyyBQgIdZgQLpao2H5LFD0tIgSMcO8hFYZ4fxI6vV4pMGxZVAtxhicMV9gq3ewLGfuCMtocM4VXh8gJ1QVhudP4j8KejvTuYPGOa1nhSYRNBh_Ojp9HZx7yVL5waiAXQ2NlCFE0HssMzKIJ_3Vg7slrbKcrYPOJDVheDhOTXix4BRzIJQAJIp4JnYJ8PlSWJN2qzDLSf6V-ybPDNMAsNeMOnO1GBC062ikrG
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2104 msedge.exe 2104 msedge.exe 2928 msedge.exe 2928 msedge.exe 2548 identity_helper.exe 2548 identity_helper.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe 2928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 1048 2928 msedge.exe 82 PID 2928 wrote to memory of 1048 2928 msedge.exe 82 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 3876 2928 msedge.exe 83 PID 2928 wrote to memory of 2104 2928 msedge.exe 84 PID 2928 wrote to memory of 2104 2928 msedge.exe 84 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85 PID 2928 wrote to memory of 1188 2928 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/myaccount/transfer/claim-money?context_data=2MarzaigiwC_KJjlGv_dzeActjo94BeuG8qyyBQgIdZgQLpao2H5LFD0tIgSMcO8hFYZ4fxI6vV4pMGxZVAtxhicMV9gq3ewLGfuCMtocM4VXh8gJ1QVhudP4j8KejvTuYPGOa1nhSYRNBh_Ojp9HZx7yVL5waiAXQ2NlCFE0HssMzKIJ_3Vg7slrbKcrYPOJDVheDhOTXix4BRzIJQAJIp4JnYJ8PlSWJN2qzDLSf6V-ybPDNMAsNeMOnO1GBC062ikrG1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa99af46f8,0x7ffa99af4708,0x7ffa99af47182⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,3080075977193933140,14778961213191117161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize576B
MD5aa593d0de5638a1e00ec8a7913c0f02d
SHA14e74003cab6045b0a0dd235ba172ea1432526b99
SHA2563acb650dd63ae840e351304fa327feff5590657deacda065555cf66bb985e2e0
SHA51274b2120cc8999c6d039965c51f2033dce157e6dd4743b411f56fe5a5ad318b9335eef13700cd2b869854ccc4583a8d195f3a8ef93e1b141f2080ae66cb2f0e73
-
Filesize
1KB
MD54528e7dd5fc0f0922cfa5ccdc82d43b8
SHA19bd0d48548f8d507a48952dcb5b0754902db1366
SHA256fd7ac45c04a12351fd66acb463dbbe9360a2d9e939c0bbe570024bd294e6f57a
SHA512eb5d3028bbf729f7aec78b3c715cf3de599df66d9baca5b8412c617298c9db63e6e462e7a90d275809fb8e692c233f5938a45166cad161769371db37e8365888
-
Filesize
6KB
MD596e99655f9a37642064cbc6cbbf1d88b
SHA1c66fa115d3af48d79ed3a0f24b55f5a2ef89d16b
SHA2561587d752a3b53d3be5024035170d943268a13134df06fb4cda02b2d023ff7cd5
SHA512d9a6ef294679ff4999c9ad1053d0067929dbfd5a55de6b100bd2e990be59af773a9a94872d8f1a1100df7d7b58b9421ca0c9c1629181d5de8af34495132bbf4f
-
Filesize
5KB
MD5f245b4a4bd67ade42781c1b0391316b9
SHA1836855ef8e82415c9ba31ff15b3b729264108857
SHA256d36b9143863249fe96689d2410a5b871a7465616702bbee422f878f38049076e
SHA51260b94b97378fcabb0886c0cc801bf1d57cc906a64c5d462c0a3dc144bc6b8a2a418b26619f6b1c5c84e83ce6e5f2002fab809a3ea5dce5e7e4a4504464249a45
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50809fd250cf468d03f6b24ff4c402883
SHA10c2774780b0568b69d22cb7306f8ddd7f6abe1d2
SHA2562d2b45b90691135f3212eba14dabc878884bae2f145cff15b31b26a8d9e2af7b
SHA512f8fdeebdd823412b66df7825335682e1fae6f64efbe43bfdd78afd27b62d774aaa83374ea398cf67976fa99ed2c6a95b553622d1dc89ee8c7f3056e44dfd7947