Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/01/2025, 12:49
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3852 msedge.exe 3852 msedge.exe 948 msedge.exe 948 msedge.exe 3836 msedge.exe 3836 msedge.exe 1788 identity_helper.exe 1788 identity_helper.exe 1300 msedge.exe 1300 msedge.exe 1300 msedge.exe 1300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 4980 948 msedge.exe 77 PID 948 wrote to memory of 4980 948 msedge.exe 77 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 2336 948 msedge.exe 78 PID 948 wrote to memory of 3852 948 msedge.exe 79 PID 948 wrote to memory of 3852 948 msedge.exe 79 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80 PID 948 wrote to memory of 1756 948 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamcommunity.com/gift-card/***/**1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbf36a3cb8,0x7ffbf36a3cc8,0x7ffbf36a3cd82⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1680,767370353347775086,16992124179516215871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4780 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7145ec3fa29a4f2df900d1418974538
SHA11368d579635ba1a53d7af0ed89bf0b001f149f9d
SHA256efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59
SHA5125bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91
-
Filesize
152B
MD5d91478312beae099b8ed57e547611ba2
SHA14b927559aedbde267a6193e3e480fb18e75c43d7
SHA256df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043
SHA5124086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize672B
MD5daaaef3a5164e0249cd4fef41508d21a
SHA144adf21c35e0c8f2315c7136eeb64ea9d35bc233
SHA256604e9126779a3031fb1f65182516fdfe67e1346bfb55377b7776291f8df66a33
SHA512c7e289944c5566a61719d24ee627f34d42527dd06b0f1f900c4897464aa87e8bdb6f177d40407263c17e0c49c49267109ec32d1c7c68b0d711e4be87c96877ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD569ac3a05b98e249f0e47b95fd220f44e
SHA1aa7cd773d3a681b73d9a76838f9b74e628548b78
SHA256b816c2e5b92b3bf328220264f6e02ac344302dfa295da1c46213a6133954296e
SHA512e2a10dc5ccb0180d13a90d8d680106a86c3aea6271b464f893fe6d014395d0fdee279847591294736f0b52bc7328e37c4bdba8c8bec22cd07268ce4b81d8a49e
-
Filesize
913B
MD5ad61ccb3a16b2cff16844c45ab5e92dd
SHA1edd580ba651e89b45d36a9287d6263c4e84b15ad
SHA256b91c1a745df073096cbf1868acf3807cdefb5483adfc3c60ef3849754ff70d6a
SHA512db714f26b49871ec67ffab38298dff176f5c3ae16b5b3ece23718e264413223eb95f168999161eb54700dcd881693c645597c0cbca75c2c906c1aeaf0f38aec3
-
Filesize
5KB
MD5f0bc11cffae96c62544af3da283bcc35
SHA19f4ad696dc98671eaa53f141233574818cd155b3
SHA256206bfb7d2318dc02146fb36473bd7f0015a31aceebae36bbdf11b67b3bfb5664
SHA51214892062fa90bd4c0792162f688a1b175b5fad850bc602afd48585453348cd1dbd46daa7715f9393b899858ef34afa1b97da939dc3fed1776f563b46bf554e2b
-
Filesize
6KB
MD594ff022ea64ad2ad5e3424701dbc64b9
SHA1bb68e608138783aeefe4099ae0ec54eff7c8ae12
SHA2566ac944dc124b65ac6b1f27cdbe9e5543612fe01f58fe8a37ce9afa20eae60f20
SHA512db849fc047b97468b5be4c515b3f4f5d35d74605eccaca3a3b880da6df2df385479a617921bf6fb754a9c9532f9c40b236fbbe94ef917b579db00f18d5c866e5
-
Filesize
6KB
MD5b4ecbf143754160cced1967e82e526ef
SHA18b1f965c5218167deb5dcc199d2a3fba000f9b91
SHA256d8e021c2f7ffbdafff9c397698eac7d4c5adb9a93584c734a118daf77b360bd4
SHA5123547f6d9dbf8f22b7663f120cb0f80cb837a5298f45633c16d1a169b3dbd72f955576164e42485addff94af79cc07c2f1f7bab3556389bb7513eec932659a72f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD59258432282001988e5b0cfe1a4dcf10f
SHA15de58d7237fa20a9db19a7b764cf0b74c2374422
SHA25620997c0c4ea29fed4a3f57210331d3226d7443b6c684fe8cb8b3045d450f0bf2
SHA512f90a7c8723ff528758090979b2fafbc93c759c20059691e0d0a56eaa6b809fe0839299971ba1c722bc47421d70ded1c5c4ec00ec6f3fabc3de7d836a2e2c4504