Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2025, 09:59

General

  • Target

    https://www.google.at/url?sa==qPF4CajfptzRAuYP7UlVCtqUujfRxd&rct=xwjpfeHeWdTpKa7CgdPrQDUfENb7DgpCczl76vjLEYAIygXJzBkH1ShcHXsdha2TA4&sa=t&url=amp/e3a.co.tz/authh/mvmth/0qtvXmrENFyQFFk2UUJb8yUxyJ6Ug1sCvua4v/YXJAZXNhYi5jb20=

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand MICROSOFT.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.at/url?sa==qPF4CajfptzRAuYP7UlVCtqUujfRxd&rct=xwjpfeHeWdTpKa7CgdPrQDUfENb7DgpCczl76vjLEYAIygXJzBkH1ShcHXsdha2TA4&sa=t&url=amp/e3a.co.tz/authh/mvmth/0qtvXmrENFyQFFk2UUJb8yUxyJ6Ug1sCvua4v/YXJAZXNhYi5jb20=
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9eb5a46f8,0x7ff9eb5a4708,0x7ff9eb5a4718
      2⤵
        PID:3364
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:440
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
          2⤵
            PID:3164
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
            2⤵
              PID:3040
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
              2⤵
                PID:1120
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
                2⤵
                  PID:4944
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
                  2⤵
                    PID:4812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4424
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                    2⤵
                      PID:3944
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                      2⤵
                        PID:4884
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                        2⤵
                          PID:528
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                          2⤵
                            PID:2672
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                            2⤵
                              PID:4412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
                              2⤵
                                PID:2072
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4820
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2056
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2084

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  6960857d16aadfa79d36df8ebbf0e423

                                  SHA1

                                  e1db43bd478274366621a8c6497e270d46c6ed4f

                                  SHA256

                                  f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

                                  SHA512

                                  6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  f426165d1e5f7df1b7a3758c306cd4ae

                                  SHA1

                                  59ef728fbbb5c4197600f61daec48556fec651c1

                                  SHA256

                                  b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                                  SHA512

                                  8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                  Filesize

                                  215KB

                                  MD5

                                  d79b35ccf8e6af6714eb612714349097

                                  SHA1

                                  eb3ccc9ed29830df42f3fd129951cb8b791aaf98

                                  SHA256

                                  c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

                                  SHA512

                                  f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  192B

                                  MD5

                                  5baab296e85cbdf3144649853c615976

                                  SHA1

                                  182f36e49b4dec38eab6f5ad45e61344cb47caa3

                                  SHA256

                                  64a8ceba3b4c50cf3723b05b0ccaf9a85ac49e936d773f9171cb9ed1b85e3a46

                                  SHA512

                                  8b0ea2a44c4f4d7530fa0235917307fe60d4ebc3191c41b97818ecc4e03f82b2cc2b83dc618670322dbf820c1e5a94e7edcaca17f14a865545d8b9ccebb3ee7e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  e1affeafe990fb0ba23aa4f7a08b161e

                                  SHA1

                                  a1fb55ec3408f17588b099ca88158e2131ce6d25

                                  SHA256

                                  8fc099170ea281fd0a89b4cb5a5b727be848eaa5c66d266f42f8ba5c905da1bc

                                  SHA512

                                  c9f26c90495cefbbe6652902b8ece293fa979b8c1536028cd2b025899242d244fd1ffbcc63b3f356e3dfd152747a1e2bd50e58e04eb3847d14b7d534a5dd593a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  32ac10713e8b42ce7cce72869a6bf9b4

                                  SHA1

                                  69f6a25d4d6cfadd64ef7c80d49b6e916ccf9e00

                                  SHA256

                                  0f3f7025d60e1a7622778c70c8597cb8ec4c6d12e5c1fc128d550eaac3ded53c

                                  SHA512

                                  c8b0e556b90789408cdf55c210562c11f8e932eab8c4b80ed9500e3323f5a13ff437a28a5922d01a4b03ab91c52fe1ed36b2802d3e1bb618ef66036ef9fdd0ae

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  9cf443e5e2195fbae4631b903f7bec14

                                  SHA1

                                  be30da99bd493ae09b67236601a33fda495fe31b

                                  SHA256

                                  66a06032f8cad4811449be085e2f3bbb16cd0b038f558545c797c96cc95713a3

                                  SHA512

                                  26a4404c6bc761fb2c95041262b0e1d5e6451fc651318f68f1ffc2424f0c50ab1e565fe8bd36efe470d0c869e2ad04a04c9bbd099ff4930d0cf881af87ebc18d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  6438c5ca48c2ac0cb6691a861032293a

                                  SHA1

                                  4211650c223e7c98feca659dad41448187eee4d2

                                  SHA256

                                  0c796b362a735430488b61e7a88cc76d5e1e531589a14f7f10588d0f20d38c72

                                  SHA512

                                  9f975c502d8ec96a1dc50d3689782f757f49ce84503f452a80a3231914732f9df854033bf29e014a2447612892258094c300408b1cc1d693ce92f7e323022a67

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  204B

                                  MD5

                                  edf307903aee208cc1a9ac2194ccc923

                                  SHA1

                                  8455c38d007732fda6daa5e732cbd97db6943176

                                  SHA256

                                  5fb4034fb4ce03905a0752744c215063db3dcecca9658023389a43acdad36826

                                  SHA512

                                  a3c98c96d0e2a5a4df4ac2b3d2c8d9cd3a1ec7fa0e7aa780f578dfc45d60b9a855d5b884cc4ceef3fecc16091ad6c47e8215f51cd1414329e44b3fc1a25a1d9e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fe36.TMP

                                  Filesize

                                  204B

                                  MD5

                                  f3aa60554e046233b6b33ad2edaed299

                                  SHA1

                                  49d91b068fc88ea9873bb591cf35f401b480c98b

                                  SHA256

                                  a0cd68ca42d097cae2daadf88998b2eca15978536b375df29fbc6367bdeb9539

                                  SHA512

                                  535e6bcd4e752072409ac799a7697b7416bc66755b4a9684761a668f529f308c34e5498b4f99d6d804d17ebaefd3324179c891567a22c28bfcb53f43f01bb13a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  3ab2698cd934eff5b05ad84fb6e87693

                                  SHA1

                                  ad91f348226714c2a931220b0b52bf484e90f4ad

                                  SHA256

                                  24a28886e44d3b38e94d02f73e4a34c43e06285fc4cd952b41ef1baef61de7a6

                                  SHA512

                                  4cce582cab57dc3c16692f542cd73845a23e62dfc495e4b945b30237533a125d147fc04a72f6887daca651dea076f1c3490064d7c21a73be7b016fda942b59e4