hxxps://tria[.]ge/dashboard

Resubmissions

10-01-2025 17:24

250110-vynssssrdq 3

08-01-2025 12:21

08-01-2025 12:17

08-01-2025 12:14

08-01-2025 12:11

08-01-2025 12:10

Analysis

max time kernel
840s
max time network
845s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/dashboard

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
4832	msedge.exe
4832	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3820	4832	msedge.exe	82
PID 4832 wrote to memory of 3820	4832	msedge.exe	82
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 216	4832	msedge.exe	83
PID 4832 wrote to memory of 3980	4832	msedge.exe	84
PID 4832 wrote to memory of 3980	4832	msedge.exe	84
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85
PID 4832 wrote to memory of 756	4832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://tria.ge/dashboard
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff06ba46f8,0x7fff06ba4708,0x7fff06ba4718
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7236649726607729758,8026683978994947152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
bd86ef7fb8bd372e79539d83cfee4d60

SHA1
5a453b45892c78c09ba7f640c3f4ff60c68df380

SHA256
34b0a2e78f6ab55a31b948c481f912ab4821cc9e3ce2ab6c33e1fc33131b1fc8

SHA512
ce40e90eac6eb4139b5efb650567f842ec9ab5e61839c85d5daac0c8d4c4ae39e18839d54d00e1bf185ad16982a91ab1bfd4e9969e1ef63061df96bd63f339cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
683B

MD5
75326543ced121bb0e7313eae1560a99

SHA1
959c8751e0fdcfd1bb06ec3f59687eff9e52de03

SHA256
14cde76cd5c63fd8a4b85fdeca6258fea1c3dda545c72f8eec0b757ac2978b3f

SHA512
bde767efd5ba4f3fb506038c04c06f253f8a4249f9a17d1a58fc6ff5ea3c43a8efb3b534ece62d77a3ab9945ac9cc7875dae014849df8c9244b56a28f0958931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac8374e8387840ee83f0d356498a1d9b

SHA1
1d405363f04da499772c66121f54ed80d244c069

SHA256
9b49f3d8c1c4c6bccc30e9c4245541868d14fd7b5c96b1801d35c4d5cf61388e

SHA512
92750e559505403f2c85f0681cdc8b811b0fce811186dcd7f37718b23b48004f651e583d4d6ee746e9b0b7a8ccc0f732ba9596c782228b0344dea9cca79a0108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd59b74e3efd5260285e7970ebe5ced0

SHA1
5f6054afb4ab4ef6129dfeda747f0b0c5fc88789

SHA256
9663e406aa3dbb35705098aa02374059144d4ed236b0c18dfe3848aa86463eaf

SHA512
a85e7ff3acd3f2c3bcee0d45316e5a6dcaff27c3f5c253a241bd578ae6d72d13bd107f9f61fffe640b080817f34311c350d02a53bfa8d0c6f375ab242a117a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e45c2d64c69e2f77b5cb5f0abb53e31

SHA1
58b88f294af1da55c2a15fd445aa2ceade13f069

SHA256
87c23b206d522d28ab83e2c318fda8a789cb3e1469dafe072713d24d664ef3d4

SHA512
f52c77738f0efce58910e583c5ca29887f246e59818f7829882e11d21505d48833f9f516901f344cc453ff6c18aba7c0f01b2b866430c22bc8432092bf0151c2

Download Submit