Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
291s -
max time network
256s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2025, 04:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1LKDnuLAMqT9VvBE0jQDj29lYNYKNtfJK/view
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
https://drive.google.com/file/d/1LKDnuLAMqT9VvBE0jQDj29lYNYKNtfJK/view
Resource
win10ltsc2021-20250128-en
General
-
Target
https://drive.google.com/file/d/1LKDnuLAMqT9VvBE0jQDj29lYNYKNtfJK/view
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 drive.google.com 12 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 1668 msedge.exe 1668 msedge.exe 1148 identity_helper.exe 1148 identity_helper.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 3368 1668 msedge.exe 82 PID 1668 wrote to memory of 3368 1668 msedge.exe 82 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3912 1668 msedge.exe 83 PID 1668 wrote to memory of 3412 1668 msedge.exe 84 PID 1668 wrote to memory of 3412 1668 msedge.exe 84 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85 PID 1668 wrote to memory of 656 1668 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1LKDnuLAMqT9VvBE0jQDj29lYNYKNtfJK/view1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83b1346f8,0x7ff83b134708,0x7ff83b1347182⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2578034385127324282,2991676472189555654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1688
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD598562d0672639daed63a0db5963c55ba
SHA1f1653d80ea9566466962972f6c75a8ec290baa99
SHA25604a41df39163aaf9e6b2fa6b81f958558dc59e020aceffefc7543930d0080f87
SHA51289a7da39b38b384384f7d49c655ef08c38cb463cb58ab8f3235f44a4c8bc25cd44a1b5143af565e946b520083e404fbffbad76dec722f0339ac9dd99448175ea
-
Filesize
3KB
MD55ec1ade55744263fc7a6bcb2399fbad2
SHA1b3f9c819838317111aa1fc4fb85d5d756154f3ad
SHA256ce837173aaaa14d588d6bfdf2de6791c1d976d605c770f7d5667e3962d219d87
SHA512e863817271f5033aa9e2ee508216dc13cf75bd09ace086abb1106b6e4555555c4abe9cad0f73a10b0fc008fb0080e6a63d22115e8c7bf3adc13f1335db571674
-
Filesize
3KB
MD5a27aa4a3f9d88a6c5c1ee504968917d0
SHA179b7b366b03fe2b07a0c1ac21421d6399a3bfd1d
SHA25639bdcf57535cb15155e695f9e4e299299926ca8f7e85c14eae9f7a87f0af30ef
SHA5122114df37effe235a9d27d563e55e32456683cfc287118a6d3dd6ef9a7869e50551ef54b0e14bc4cc6a9d8fd579573075c88c8a7046f110188c9890be06c909c7
-
Filesize
3KB
MD53f90508e22b27d8eaa9b89cc67766670
SHA137b65c3be00dff7d1c2254a54c3ef0e628f7c38c
SHA256898ba2bb22c9c448c524fdfa1b67e3a84312a31901c5245e065bca754c31d409
SHA512bd1c3cfa244c862187c6b7e966709e02ac5f1ebe407cb24e04e1e4327556188f0ec2e9c309a89d8b0b19e32e415798b9d9f8368899d7022a771c8f1f302a4fa7
-
Filesize
3KB
MD5f108d9453421c919a2644b66e25726d2
SHA14e97988cbf25701bf7f7d536734a1b6acf6bc3b1
SHA256a5f758fd4614ae72decf618c0e09edaf590fbcffb715d30cc535040a936766f0
SHA51241fcba95112d07cebe066dff17972d2fd2213d14d4380fe5af167221041d45252cfc9850a7495733cac8734bb2525731583677814e73aef18dc76fd3018323b8
-
Filesize
6KB
MD50a009197d75753c24802850610c366b9
SHA1c91893ec5a418a508c6abe503ba2179a9f3b1556
SHA25618ce8b1814ad3af95ff4cebb7cd298c8fc884b9ba79a84ffcf0523e932ce55c5
SHA512f304316e6f9426131b49d774c693d09c8b210532f6d305d800b06155c261def487e65bab4f1454ef05a396ab5eb21c6001f2fa0d6a4293e975560ddf3f8832d5
-
Filesize
6KB
MD55166f97650c883d5f9dcce740ea5fa2a
SHA16f548d23b296c477f1b5187858ed3cc92a10ed90
SHA25640f55f5ec390d64aec3f3196bae7b55b63c705ff606d697db239b704ca3e6b39
SHA5123ff5971e0f3eb954eea787e951b0469a1d5f46f2c54ba09c6f10c794ee8c3c909d2772037a0f76557484d8cc662ab21de5165ef658a59bf7c6a3789443aa790a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d87777bc-0c9c-4dc7-8f1c-0b06ecea99d4.tmp
Filesize5KB
MD5e10e0e98a975edec4050cd0aae3b89bd
SHA194222aba95c5e581591e3df0e6a17e95f2f3e0c6
SHA256dfd416bfb643f6a1064b18f55a4faa0269295c931e89ed4e24851ec68e786224
SHA512a8f57d3f07c5c883232a351b2b1b41c0fd9c1ec9891efcffcc7b624cb6db3d91bf566b54ee336af4037689a36b0c00cfd41cc93de6bb47fa4792655863eecadc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5129017b44944caf99d5d0896e25e63fc
SHA1c9ea5a3bb2b1ec0e2a3eadab007025360f5c42f3
SHA256a7f388bdba311a18a76f58452deacdcf02c4fbf8ae8c87448175f9741cfad224
SHA512dc72b9ed3a14968b59025a52ea48ca4b320eaef83f6d4ada316b9294a7f6e576362f052550f31ee195407f553fac9ce2793c8bbd398da327f03ff5e0ed0919e6