Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    383s
  • max time network
    1588s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/04/2023, 08:19

General

  • Target

    login.html

  • Size

    26KB

  • MD5

    0a0f515dc55569bd4b16539e1171fe54

  • SHA1

    8954b72527e7c978299404462f0a468e048cc0d6

  • SHA256

    23461fa7ade2158721a76b7c2c06c377fa0c1f4eb58447d7050b73fc8bcde8ee

  • SHA512

    f17d31206906c8371ea47ddcbe9e00ad7101174b5abf26babd2d6fcd745f5c72da45ce2870602f30899847f9525c2c770102d5931a555bfa3862a16865482a30

  • SSDEEP

    384:GZ0e3ujIp/n7M0IQqC9RZfxSAZn0fZ9effGfMfgh3syZj5XCqzGX3w:i0GugIqjfxSAZnmZI3UWglsyZ95

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge C:\Users\Admin\AppData\Local\Temp\login.html
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1680
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1360
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:2812
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3496
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3180
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3080
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\edgecompatviewlist[1].xml

    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

    Filesize

    207KB

    MD5

    e2b88765ee31470114e866d939a8f2c6

    SHA1

    e0a53b8511186ff308a0507b6304fb16cabd4e1f

    SHA256

    523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

    SHA512

    462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inegr2kr.frg.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • memory/1360-293-0x000001D00B9D0000-0x000001D00B9D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-290-0x000001D00CBA0000-0x000001D00CBA2000-memory.dmp

    Filesize

    8KB

  • memory/1360-159-0x000001D00C720000-0x000001D00C730000-memory.dmp

    Filesize

    64KB

  • memory/1360-175-0x000001D00D000000-0x000001D00D010000-memory.dmp

    Filesize

    64KB

  • memory/1360-196-0x000001D00B9D0000-0x000001D00B9D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-198-0x000001D00C8F0000-0x000001D00C8F2000-memory.dmp

    Filesize

    8KB

  • memory/1360-200-0x000001D011240000-0x000001D011242000-memory.dmp

    Filesize

    8KB

  • memory/1360-201-0x000001D011310000-0x000001D011312000-memory.dmp

    Filesize

    8KB

  • memory/1360-297-0x000001D00B9B0000-0x000001D00B9B1000-memory.dmp

    Filesize

    4KB

  • memory/1680-129-0x00000181F4520000-0x00000181F4530000-memory.dmp

    Filesize

    64KB

  • memory/1680-125-0x00000181F4410000-0x00000181F4432000-memory.dmp

    Filesize

    136KB

  • memory/1680-130-0x00000181F4520000-0x00000181F4530000-memory.dmp

    Filesize

    64KB

  • memory/1680-131-0x00000181F5070000-0x00000181F50E6000-memory.dmp

    Filesize

    472KB

  • memory/3180-212-0x000002247DB30000-0x000002247DB32000-memory.dmp

    Filesize

    8KB

  • memory/3180-226-0x000002247DBF0000-0x000002247DBF2000-memory.dmp

    Filesize

    8KB

  • memory/3180-228-0x000002247DF40000-0x000002247DF42000-memory.dmp

    Filesize

    8KB

  • memory/3180-224-0x000002247DBD0000-0x000002247DBD2000-memory.dmp

    Filesize

    8KB

  • memory/3180-218-0x000002247DB90000-0x000002247DB92000-memory.dmp

    Filesize

    8KB

  • memory/3180-216-0x000002247DB70000-0x000002247DB72000-memory.dmp

    Filesize

    8KB

  • memory/3180-214-0x000002247DB60000-0x000002247DB62000-memory.dmp

    Filesize

    8KB

  • memory/3180-210-0x000002246CEF0000-0x000002246CEF2000-memory.dmp

    Filesize

    8KB