Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2025, 18:19
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3580 msedge.exe 3580 msedge.exe 2644 msedge.exe 2644 msedge.exe 1648 identity_helper.exe 1648 identity_helper.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe 264 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4032 2644 msedge.exe 83 PID 2644 wrote to memory of 4032 2644 msedge.exe 83 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3600 2644 msedge.exe 84 PID 2644 wrote to memory of 3580 2644 msedge.exe 85 PID 2644 wrote to memory of 3580 2644 msedge.exe 85 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86 PID 2644 wrote to memory of 4188 2644 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.jotform.com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42b946f8,0x7ffb42b94708,0x7ffb42b947182⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:264
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize648B
MD5eaeea1ed7b26da21d5f1a4792f0171f5
SHA12d46ff145285e5438f194edbf9fef3238744205e
SHA2566e96d7a0e49d0605b085d35e2a80f094c74f2caff5d8a84ea10be9a3db10a3f9
SHA512c4d6b6ced1fd18146573d6d456d385394fdb627896147896d1ce8e4aa534f3d0b1fbe28fdffd6e7251e429083c65790ab43a966cc724da735cb2aff62949ddba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5a50df0b7c11b140ec426dd4436835b0c
SHA114b6fd196596d1aa7a0989a3970b2d279222c59a
SHA256ff5e926fd5300cbb446d89a9a7dd0bd66b1b24c80266f6363cef52cdd01bb8d1
SHA5129220d1c3203a682210506468cbadb7870a9ae4a9a5a7edbb9ff7920f0719cc549d49ddb92d9211c7e5917179df1c4bf0278880e7a32c9c14990e42d34cea7380
-
Filesize
1KB
MD5833a4050b1530a63f5c2383af2b37b78
SHA19c8d4e7afb6271caaa446a1d3ed8ba4550464e12
SHA25606b3517c17387bc5553c21550571bcd87929d8066d7c30a9921c8db02644e668
SHA5129e475210fd0b9e97942c8cc39513ce3559ff85b94c3eedfcc9d996fad0899afe0ab469b9c539378efae5354cec7cbd555c82d2fedfb918d3c04d9f353f19a9c9
-
Filesize
1KB
MD50d4bf2ac341a6d358bb03b49b14e9a6a
SHA1df4a93146b2280f9aefac3b68c71a4543d70484f
SHA256f33be6bda1e72d4611f3a7dcdaa7de4cc7811ecd95bbc2e8b6b5ace9cd8eea72
SHA512bbaa3108bc5d7874066a382488ee296ba6ac55405ddef5ec7c6e56b3e6cc9d2645f515b3096ee75289c1e6ce358f38816f931589be712e54a0a0d35197f1d3dc
-
Filesize
6KB
MD5db6533e4cc16da56bdb72a4d06103c82
SHA1a0522c95885009a871b17b4d0b13a688481564cf
SHA256bdad242b38ce5cde05e3ac7577bd87e6c542e8f5af4bc590ca343ea8a8a0fcd4
SHA512bbe3911f652dff3bf602288193d04fc12590c6132ad172cb57ee61326de598789507ea7d76e3550fd1d675fc7a4fe52a862f7ad043e282b7e4a853e9064beb69
-
Filesize
6KB
MD574194a896c1ccd5532230f8913769b93
SHA18b3891309c588b7abdad791eb0b57ab2edf07757
SHA2569e767449fe3aa5c29903e402902f1f218f24ff26c4e09e84ae276af2227a7363
SHA5127fbd0e196032429a8aeafac6f04bca38345b7309aecd763399b60e8ee81a9ea49ccf308affbaf8bb9623d29b5b2901a9fcd7b7258ccfb4ee7b90ac71fcb0910b
-
Filesize
5KB
MD5593fd3ce2314fa8c7a850abd1776b13c
SHA1dca501ff8ec40be721ec6c4e7bb18061c5b8cc38
SHA2561ecc9d8b50a5d11b8c700d3e5a3cbce190af63f70072398414cf41713ea85b96
SHA5123d853e3050210bf1289d5989265a27a16022a8bbc90d5eeb68eddbcba761af147ad2c623bc89358f1ce7e6949cfca36dd1c8785428b1eeb94f007f353be6c15a
-
Filesize
6KB
MD5c286cb838a9b4a0fc12150a1babc541f
SHA15e0eaca03e48e1787bd034975d3bdde54cc79364
SHA2567b732ce9448dd20bd788f1b09f6fbce8d8ddd9b1791dd081d68dccf2e4cfb1f3
SHA5127a7612521ed4d0029eed2baef3768107ddc291e73fb98e65d3b8d4594eb6881cc6842ccc8768db96b5312262a78b3176363a9349f5a7034932e115d297eab28e
-
Filesize
875B
MD519a1d28c29f3d5c274d48682aef74dc2
SHA1b3812b622ec79923b338625bbfda3c13fb455a36
SHA2561ebeb7f511cea736ab4da734c2dbbb02e0bf896d031b8c5fffd333498026f774
SHA5129668763ae270eae2881ec75c99ca2f79d324e3003e24af95359b0f51ae8d6d1a4971884a6bdd3495c5bff6b9f32a57c377a1bcd34e055079835fedeaaa018a18
-
Filesize
875B
MD5d2607353c42e67d9d99288fd8c96c4fb
SHA1378ad78cd538c828055fee7ecd371ea8b98f0d78
SHA256c5caccb9093590321109be3362f374335b44521a856528d76f43f1ce8f0fc1f0
SHA512823bc5cc7b1221449364a5112c86f0539121bd3e45a6e43e4ced727b88963bc6b8b7f56f70a1a497c11c84f4a504f888e3eb6477d7c398be99fbf3c2eac8955e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e656c1b1836853c3a56d2b87fa79c7cd
SHA19a60dc81fa18ea44aa173d3990f728a7a136eddd
SHA256ef018285a1724821eef73e03b4d9b99609953a9459fbb4a2ebcbddb51ae1e689
SHA51208c699ccfc10db0f8561154add79353e6a248cad2816e6617f9b3290c53d3c3188dd6a8f373f255f8fb067551efa663e853deefc307970aaea30cbcd909e60fb