Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/11/2022, 10:23

221122-me2xbadd8z 8

22/11/2022, 10:19

221122-mckj9add2v 8

22/11/2022, 10:14

221122-l9ql4adc3w 8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2022, 10:23

General

  • Target

    StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe

  • Size

    4.3MB

  • MD5

    19079710e724d00ec52a979335797a6e

  • SHA1

    d28f13775018622f1f3d2a7c721d2fecfee18998

  • SHA256

    93ca5549b18737699deb942e2404bd373b88f72d2b5d4693bb68456c6d84da02

  • SHA512

    ecf31d9366f8cd66759dc15daffe7ea3a0538e07ef13c36bad45db24b0833a2ec8e5b5e36bb711b3209227b8371486c051f0a65ebbf1f47a6b6707df4a0b32e7

  • SSDEEP

    98304:tkLt6hB0m9WZXk8a7EdrL143hPZmKAdKwcNtDGdPBmM:eQBf9WO8amCRPMLKwcNcdPBR

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe
    "C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\is-RL66I.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RL66I.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp" /SL5="$D0046,3475251,1235968,C:\Users\Admin\AppData\Local\Temp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://paste.sh/U_bf4h9Z#aLacLL88NVkuNBDqoT8H9nY2
        3⤵
        • Adds Run key to start application
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc934346f8,0x7ffc93434708,0x7ffc93434718
          4⤵
            PID:3656
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
            4⤵
              PID:4764
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2212
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
              4⤵
                PID:2880
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                4⤵
                  PID:4440
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                  4⤵
                    PID:2004
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5104 /prefetch:8
                    4⤵
                      PID:5104
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                      4⤵
                        PID:2612
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                        4⤵
                          PID:4028
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 /prefetch:8
                          4⤵
                            PID:4644
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
                            4⤵
                              PID:4140
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                              4⤵
                              • Drops file in Program Files directory
                              PID:1456
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff681e95460,0x7ff681e95470,0x7ff681e95480
                                5⤵
                                  PID:3172
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4816
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:8
                                4⤵
                                  PID:4640
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:8
                                  4⤵
                                    PID:1756
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 /prefetch:8
                                    4⤵
                                      PID:3136
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 /prefetch:8
                                      4⤵
                                        PID:3936
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8997861424756894129,8887751119973170454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4612
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1968

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\is-9S0SD.tmp\AppUtils.dll

                                    Filesize

                                    1.8MB

                                    MD5

                                    61313107f86efd528d5e0b15fcc8b8c7

                                    SHA1

                                    4de55bee0decf620de12ee49d8d94d6796d59721

                                    SHA256

                                    99c01c23b88ab7e656ccb05200fec3c12779de7e20fa20aaea034e7a12fc90ef

                                    SHA512

                                    7fcd8fde1ead2ee6e879240f55f3ff4db17e7f716c3fc7f28da1464ed4a1760568427584fe34cfea945c64ab9a8db7b8d50e80e3bc27b8c2c1103aa6846a9dc2

                                  • C:\Users\Admin\AppData\Local\Temp\is-9S0SD.tmp\DimensionUtils.dll

                                    Filesize

                                    1.9MB

                                    MD5

                                    21da787bf4014ee28ba649bc0335f012

                                    SHA1

                                    9ae7f559a3f925e533f1526722118bb16672ee28

                                    SHA256

                                    9f5e08b5309fde308dc9786e98e90cb3661fc06ac8dfdfbfa550b5e62b083564

                                    SHA512

                                    0b44ca41123d4cd94acb192e2865e4e7bfc4c0c80722efb59c40675f76eb06e042d889fb2a01caa0f371abce69c387ffe4e50b9d6fa16c25ef03f20989c3c3a5

                                  • C:\Users\Admin\AppData\Local\Temp\is-9S0SD.tmp\botva2.dll

                                    Filesize

                                    37KB

                                    MD5

                                    67965a5957a61867d661f05ae1f4773e

                                    SHA1

                                    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                    SHA256

                                    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                    SHA512

                                    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                                  • C:\Users\Admin\AppData\Local\Temp\is-9S0SD.tmp\botva2.dll

                                    Filesize

                                    37KB

                                    MD5

                                    67965a5957a61867d661f05ae1f4773e

                                    SHA1

                                    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                    SHA256

                                    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                    SHA512

                                    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                                  • C:\Users\Admin\AppData\Local\Temp\is-RL66I.tmp\StupidIdiotCafe - Linkvertise Downloader_u7i1-f1.tmp

                                    Filesize

                                    3.4MB

                                    MD5

                                    2d8c736e49d6c7b4739418277a32d16e

                                    SHA1

                                    ad2fd43457b75de6af95d1af03edc9c45c9717d7

                                    SHA256

                                    94e86b57bd15d1d8580cdaab9bf56cab05821598ed0c61c153d3c25da417de57

                                    SHA512

                                    01822b7ee33f78ac78005e4184ec67fcf062113ed853ca388bf457652948fc714ffc5d10ff122414e4d74812096b061f13087c673983420d930a108df901e638

                                  • memory/1488-136-0x0000000000400000-0x000000000053B000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/1488-132-0x0000000000400000-0x000000000053B000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/1488-142-0x0000000000400000-0x000000000053B000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/1488-145-0x0000000000400000-0x000000000053B000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/2348-140-0x0000000005680000-0x000000000568F000-memory.dmp

                                    Filesize

                                    60KB