Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2023, 01:07

General

  • Target

    541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe

  • Size

    30.3MB

  • MD5

    f1f4e5b1fee87e3f5c9a9acab413ac2e

  • SHA1

    59f298a3ecfff597e0f66f99c240e922c860e853

  • SHA256

    541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e

  • SHA512

    3810f39cf09e9651f3fc52c22c335d8ed6f78635950ceb31e65ac2bada578b904529cd2bb3fe4380aac5a16f6c373d1f37d6897e8a138d7320429772607e5c6b

  • SSDEEP

    393216:esIkUsPzThci2CsLVWXb1thPvJm8W5olGa4YH:6kodCmWr1v7ZlGgH

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe
    "C:\Users\Admin\AppData\Local\Temp\541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.20&gui=true
      2⤵
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c23946f8,0x7ff9c2394708,0x7ff9c2394718
        3⤵
          PID:4916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
          3⤵
            PID:4164
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
            3⤵
              PID:3632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
              3⤵
                PID:5052
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                3⤵
                  PID:2120
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                  3⤵
                    PID:2700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                    3⤵
                      PID:1684
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5112 /prefetch:8
                      3⤵
                        PID:1156
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5464 /prefetch:8
                        3⤵
                          PID:2272
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                          3⤵
                            PID:3404
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
                            3⤵
                              PID:668
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4404
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                              3⤵
                                PID:4196
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                3⤵
                                  PID:2284
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                  3⤵
                                    PID:4580
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                    3⤵
                                      PID:1924
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5496 /prefetch:2
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2632
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1104
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4532

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      a7ad9bb1054aa03e39b3554833d0c3ec

                                      SHA1

                                      cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

                                      SHA256

                                      0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

                                      SHA512

                                      d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      312B

                                      MD5

                                      e3f1f045769959a67f1db022f1090139

                                      SHA1

                                      eb264dd212c5b48fde3612916d2ef413708a5c8b

                                      SHA256

                                      414fdf0318b8e376a1618cae0b6a748a4ca6b543e2f8ec20e276fb44f16c1657

                                      SHA512

                                      848694414a90dabd44c187c12b5ffb625681bde80d8c1b643fd62e9f1f85d12652af070bda9fed791481b67d38c1623617b79ded7a92034e647290e249601849

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1002B

                                      MD5

                                      b5f30b23c97d95daf3b0e326448a115d

                                      SHA1

                                      3d167a4ad1506b7e6ae0373e312bbb2c1c4ac6d2

                                      SHA256

                                      9f279e5bd50c309aa82b6694a234392abd7eb7ffeedfc166b6bf6dfd7cf08d60

                                      SHA512

                                      ff65275ce86223dc213f1302740b058de97a8ea8b0a02d6ae287decb967ead28eacf955f3d663455bd3fbbbc6e8f63216ecbce8a0ae1da20e5195bf6f30dfa0c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      902B

                                      MD5

                                      a904591b983a48b5e587d52a313e992f

                                      SHA1

                                      6f62e1a04d4d3d2d65179cc52dd8aa0a2666b0e4

                                      SHA256

                                      a4c7e19f30386f23c1cdce742aa59003cc3ed5196165eb467d2e7d473bf6ce63

                                      SHA512

                                      b26219e20de3814a259ce330756eb0faf60a6497304050eeb587a0bf1419a26856111cd42d60db610e4eb289d3d660e300392c9b03449c67f06e9a2aae5599b5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      285252a2f6327d41eab203dc2f402c67

                                      SHA1

                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                      SHA256

                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                      SHA512

                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      e2d6d1840a9c1d1cf39c9da649d55a93

                                      SHA1

                                      aebe5dbc38d828eb93608a797e208a16ed8dd33a

                                      SHA256

                                      0eb43df4d5dc5675f877c5dbf27381cf9033ee3f2259c5801b89810336564ebc

                                      SHA512

                                      a6674f583e4a0d28e662d4893a97fd12d532dba29f095684ca10e5cc155553337f356074514ac1ce40d52a5ee12b704a6425bc60f7dafd15db061434a67882ef

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      97f1573ad51951aab266a402561fac34

                                      SHA1

                                      23f31b074e6d564eae0656353a5670a04cbfba0b

                                      SHA256

                                      881587465ae635d2bebaee306b30215d9222728faa936d4584d46b15603e729d

                                      SHA512

                                      b7ca84398804f023347d0a064446800d2b9313b8e3d381b2a27ae3c70bfb97e696085d4c33a6678612bc09279432e2b1cceafe3f1d7eea68dc5c88c72d50da19

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      e62cc4051e1f8eaa0abda5d730a2496b

                                      SHA1

                                      d15346e40b196bc313cbfe5ac96b3c90b83345be

                                      SHA256

                                      ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

                                      SHA512

                                      3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      707B

                                      MD5

                                      2b394da3099e92f88870b13d108ff92a

                                      SHA1

                                      6367c9d296d77b0fbc784cbb1c07378f9bd22b44

                                      SHA256

                                      1c04aac3a7d80d5c39c54af988f43d592a69ad501b3dc1248ddf23b0246af153

                                      SHA512

                                      7f5bbb66229702ca7206acd27ae01e0355d341d6d1e6525b041cb0c1f0435d286636f20dacde0d030f054990f794c3f6c62a1e636c01ded496839c6cfde88a55

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      707B

                                      MD5

                                      c6c7864dda17050539b30ace408b4bd7

                                      SHA1

                                      188085aa042c152c6a8719db99da1e2cf9bbac5e

                                      SHA256

                                      8ae8ea3f28e7897bdceb8646e404270cb518320daf2c6bfafebd200bed554992

                                      SHA512

                                      131140a80bf9b05b5798fda70847928ae3d77d861c6f32fe160f73d836c94e1a166aa8102c627b78afa22a332a564ca87b4e229b09330535903eacfb607f02b0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b939.TMP

                                      Filesize

                                      539B

                                      MD5

                                      ea7d117e78228e05b6780d80257acc39

                                      SHA1

                                      7285d2d447e2c3741ac22c15191a84a94f244045

                                      SHA256

                                      868e3c4a0031bd2d4ff288be68033b6b60d26d9e44775335135edeb33b8e5b1a

                                      SHA512

                                      90e3a2e2b5d35622577bfe0afaa3940688d9753ac7d28938abce4698bb365bf448362fad659f9ca56d4ab1adc3277b29560d754767c3a98a34e80e28e009d27b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      12KB

                                      MD5

                                      67ec12b9bdf72e3a4cc3832656fcf391

                                      SHA1

                                      35e1827a7184394f93cdbbb0b01c15ac806417ee

                                      SHA256

                                      1ddc6282ad2952255668a406d641dd10f22197b2d3ca6b08b38fee6964a683f1

                                      SHA512

                                      83e55174f72af365eff1244d0c84d5756e13a5c4f5a4cf6685ae48e9396293c3e38f4100ef9a342c85ae14b485ff0c2d5cf147809f3c7efed152e83633a4a401