Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2023, 16:11

General

  • Target

    https://bafybeicbnc4onhibjnkwb26n6ps3pydiu3yste42jsbxu2tz5opktevflq.ipfs.dweb.link/original%20wetransfer=1.html#[[-Email-]]

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bafybeicbnc4onhibjnkwb26n6ps3pydiu3yste42jsbxu2tz5opktevflq.ipfs.dweb.link/original%20wetransfer=1.html#[[-Email-]]
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93f9346f8,0x7ff93f934708,0x7ff93f934718
      2⤵
        PID:3092
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:4368
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
          2⤵
            PID:1980
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4652
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:4792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:1904
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
                2⤵
                  PID:1096
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1260
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                  2⤵
                    PID:3896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                    2⤵
                      PID:4896
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                      2⤵
                        PID:2268
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                        2⤵
                          PID:3740
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                          2⤵
                            PID:368
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5904
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1996
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3448

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              0629525c94f6548880f5f3a67846755e

                              SHA1

                              40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

                              SHA256

                              812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

                              SHA512

                              f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61b77717-9600-4e99-991e-1ee0bf4ca5b1.tmp

                              Filesize

                              5KB

                              MD5

                              a827e48934a23308637224c119553f5c

                              SHA1

                              6a5f9bf7fc0fc4b57229f9c551c053ec410eff5c

                              SHA256

                              ae7ed24130853235c0cd45de5d361076d996a52ddb64600cc98c9174da5f9fbf

                              SHA512

                              fadef302d45332648ea1cb65b4714b513d5f6d4913a9ba637ee13b7c64e47011f12a99970113c0e0f15f9a55a37a8c799e1397e73f52608ca5615ad88b9e7100

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              e8a24c2093ef3ac92aec56659e0b09b4

                              SHA1

                              38c5de28ebc9da62c83c76b4b965ec273c49ebe3

                              SHA256

                              15ebc9f6190ad9dab66fbcee117450ef01343d7cf7142c0677e1362409d76dc5

                              SHA512

                              65c5a4557dad856e40bc5e9a92ada7954aa733e0366512fba9e1f866fce8159b323beaff651524cebc217bb49cbd19729c4425a72db388be3a872ae325f767b7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              1KB

                              MD5

                              22bef4a7efaef0d8af68bb2c17e7ec30

                              SHA1

                              17a8da2058aa347ca203f0fdebf58d385ba098ec

                              SHA256

                              2cd58c87c1c3e35cdc4712fc025afe6f07def9b56e7eb9714461b4817f47205c

                              SHA512

                              6df1f60ee4d808308277b67048ac75b562bd918440543faac73050e44eb50ba7851425709e97418eb6cdb92e7293270982d34e5a8e4fa1100fb1252b6d798c40

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              013442462e31b87a3ade1ec574019ac1

                              SHA1

                              bd6fc7921625e0974e6f270f1f44b16a74dde4e3

                              SHA256

                              e1bd8d42673dc61673009820c9f0532b629678394ae01dfbb6506693da6baa1c

                              SHA512

                              08b8c14f59aae2616eca38c18d44a50cdfd888b8978501aa8fa201f79bcf3729555f7a28e7013792937e6138babbdae26043b046853f4c3969c68b8a2c04af43

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              580e067614856487c4266bfaaf1ae550

                              SHA1

                              2e2043a33368ea8a9c74ab61b160606b79c758da

                              SHA256

                              8d1f4b68dd5170a8a1d918d1495f4d9b2bebb6599063c8998546ccc9ab828aea

                              SHA512

                              89aa4de6764d6ac1acc53e4762d762c0543ef2bfd93216b47e536eb9e8bb87eaca05e96d3f421bfdff6355887c3695f21c19ed8cd21b3fe8e8e2613ceab05a4c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              eb4c5db2c2dad9a498670d4fe40a0da2

                              SHA1

                              c8fd20c265fd3af4751c3fd5af8fcfa9d476cf99

                              SHA256

                              9e39f34ed2de4476e040bf12daeacd69ff5c9e965c1b7069f82afc4e4265ffba

                              SHA512

                              835ed65b2da38b3001e84226cb62be2ae1aed6070bd17b89bc8c69cef89d542421d33f790c7cf27e87903aefef4211131f99733b680e4606d15953f6ae90a1b8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              00c5a4cacc305d03e809234ad1f18a5b

                              SHA1

                              0cf020f762b9783fc6774a793efbfb0343668ae0

                              SHA256

                              0f5523b09658f229dffaabbc36353cc55dc55c5ba56397b404ac45098b823aaf

                              SHA512

                              7d5e5495f70296d1c32be61b394e202c568463e962b48ebc831cd153196eab39708559e8a7a3217e77a1f3c64bed10486a03075b9c294cd30a2cfff207c672c7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                              Filesize

                              24KB

                              MD5

                              fd20981c7184673929dfcab50885629b

                              SHA1

                              14c2437aad662b119689008273844bac535f946c

                              SHA256

                              28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

                              SHA512

                              b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              f0407ec4ec3bb49b1231cd716d161f27

                              SHA1

                              aa4ce7ba6b161ac13d54de447a6a2a984354b365

                              SHA256

                              c8f220545977cfc836a9d3a1d9543feb26e18da5bbca77543a5dd781b0e42ce7

                              SHA512

                              aabcdf80fbd0991bd8068a03402539f511e4c6283bf381d530683dcfcb9138752c6653a6ec57c34d4ee1be5374d5ca0adfa088acc632d75ad8454c62ec732651

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              c1037b6b8ad375a31a31c4705b00bebf

                              SHA1

                              60664ade594cda478e6116a5634a46d8eef6af32

                              SHA256

                              f7b1a687000720ad2b70c59dded1df919aed6c6a605030fcee0448d237007b3a

                              SHA512

                              f98f385839c771cfbd0c7f5cd3636be43482733788d6b93a1f0143f6c73bd15ebeaa43e0ca2ec122e13e3f7e8461182c6f6e9e57969c00bc5f6a01369f950e5b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583822.TMP

                              Filesize

                              370B

                              MD5

                              ec2da747931ed0584e2564ef8c31671e

                              SHA1

                              5655591aa2bec5b799238ba02c8d673876600de4

                              SHA256

                              29fdc8a9e31d154c753ab8816c2dd6444ceae0184cb08e4636a223cab42a9b14

                              SHA512

                              e9d6ae679a1ea8367cc2a035fe0bab1d6e8c0a80a162435af366960461645bf9db43cda1901089d77962665d730cbba787169988d44f030acea7c89b4bf95db9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              f2d3fb64fb47ca48201942fcdb2060d8

                              SHA1

                              d438c0643cb619a0157e86d9bb9bcf1ca6870902

                              SHA256

                              4647509b3cfba0dd6b4a335f161a552763667e18fd20f42c5dea6b018eacae75

                              SHA512

                              109bbfd44eadeb4949905e1b1b57de0ce7313a22ffe50b973d24a6bcb359a045c8be32f4942ffeac670900a169c9412da9301e079d20f1a93452908559ae6f3a