Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2023, 11:26

General

  • Target

    https://notifications.proxyclick.com/ls/click?upn=yz-2FS3i9Mo1-2BbYY08l0AbctIuEp-2BUDRpef6nbrwP2ZDmgQN5jtJ-2BFB31zMyv0dqYkYTZwf3Z193FGBcaBR67UzdJxasIZMtwzDXGWo0i4vX8r8x8jblPG28LM8MYdkVBJ4dirsFwEDg1LWYaFKMeCwFt-2BumdTMfXybn1nQx4rHTp9RRpHmSAmysYjdX7q086PnUCwr2lcW0XfHUuUU36lzc-2FuQ8-2FdrqRu1oAeI7m9qrkVtRhedYuxfLCpgoymX3JEawuUmQiBz-2BwJQJapvYQNyoBj39BCmEpTwuHN-2FPSsSeM-3D6LR9_UjuXtHjpHNrQkHhOUKYAq8Y0IIO6x-2B6ggU4uBSB2vLrgPbOfyKrllGnyBSSyZon7CW53gg2nHkEbijkJpzq8Gub5doR26VnxyKGCAJymhsd5G2PfwbHjhhsc3614DPYl7I3l3oscZ9MD9KYQIQiVnclTn25DOVqQdFUD4AC1H3GjAtqS5pyUibE-2BtFKCdqFz6GNzeetjTC4HOXKW31sYqkb5K7-2BTZqdsXfCJn6XRbzHspAHffFdwvIxfbof7M4KcRVgPNSbqKUqM-2FcFS7NYKSxHNUK6ut4J28mfIhNbvb12V2QFWm1raMLEx5f0MCDHN4FAG8uijXHf-2BGjF2FvOJ8XFl5IIkzFYLlj1cBQ-2FBVKYPpubi2uG7LB6AL74CBKOaqjUYDcAf-2FMyU-2FHnd-2FPXVnZSVAsR0iVl4ovsMIIuKs88L4t4KIxVyndGU8hU4qYEj

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://notifications.proxyclick.com/ls/click?upn=yz-2FS3i9Mo1-2BbYY08l0AbctIuEp-2BUDRpef6nbrwP2ZDmgQN5jtJ-2BFB31zMyv0dqYkYTZwf3Z193FGBcaBR67UzdJxasIZMtwzDXGWo0i4vX8r8x8jblPG28LM8MYdkVBJ4dirsFwEDg1LWYaFKMeCwFt-2BumdTMfXybn1nQx4rHTp9RRpHmSAmysYjdX7q086PnUCwr2lcW0XfHUuUU36lzc-2FuQ8-2FdrqRu1oAeI7m9qrkVtRhedYuxfLCpgoymX3JEawuUmQiBz-2BwJQJapvYQNyoBj39BCmEpTwuHN-2FPSsSeM-3D6LR9_UjuXtHjpHNrQkHhOUKYAq8Y0IIO6x-2B6ggU4uBSB2vLrgPbOfyKrllGnyBSSyZon7CW53gg2nHkEbijkJpzq8Gub5doR26VnxyKGCAJymhsd5G2PfwbHjhhsc3614DPYl7I3l3oscZ9MD9KYQIQiVnclTn25DOVqQdFUD4AC1H3GjAtqS5pyUibE-2BtFKCdqFz6GNzeetjTC4HOXKW31sYqkb5K7-2BTZqdsXfCJn6XRbzHspAHffFdwvIxfbof7M4KcRVgPNSbqKUqM-2FcFS7NYKSxHNUK6ut4J28mfIhNbvb12V2QFWm1raMLEx5f0MCDHN4FAG8uijXHf-2BGjF2FvOJ8XFl5IIkzFYLlj1cBQ-2FBVKYPpubi2uG7LB6AL74CBKOaqjUYDcAf-2FMyU-2FHnd-2FPXVnZSVAsR0iVl4ovsMIIuKs88L4t4KIxVyndGU8hU4qYEj
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:440
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0c3d46f8,0x7fff0c3d4708,0x7fff0c3d4718
      2⤵
        PID:3456
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
        2⤵
          PID:4968
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5020
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
          2⤵
            PID:4776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
            2⤵
              PID:2720
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
              2⤵
                PID:4940
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
                2⤵
                  PID:4384
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2524
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                  2⤵
                    PID:3632
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                    2⤵
                      PID:4560
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                      2⤵
                        PID:5028
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8623515332130486894,4878506458566127037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
                        2⤵
                          PID:4672
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4280
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:5016

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cec72c3-908c-437e-b134-b63c11f03e89.tmp

                            Filesize

                            10KB

                            MD5

                            311ca85144f838a4b953f58312835218

                            SHA1

                            09469c04d08306de4dec613607aba72e74f76c59

                            SHA256

                            b0e51553bebaf9e970f6ea2623de25ccfb72ab8a5781ec21d14d02dfe238553d

                            SHA512

                            29589612929c0ee8fd3faee4bed351280ae8c4c91dfbd7f82e1c6ac4dded4c9e93a4debf44bd8cdf311a46ac737f28c3b3514624e9efff27eb77c58a7d0982df

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            aed593b08b94f34dd8f68fd369652ac2

                            SHA1

                            3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

                            SHA256

                            5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

                            SHA512

                            16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            264B

                            MD5

                            0ffd921c77951a0755c215621d06419e

                            SHA1

                            0652daa31f23569bec022d1bf90ce0ceb8564629

                            SHA256

                            4878e76e048b16502c8624a68e73b9145942d8b1b7b2a659fa8c94c29910c6ec

                            SHA512

                            4b1e1683a3570ebe345c281a64f00f32cc72355baae5c41f8fddc2a955762a5cbc09af9a6cef544f135b0e4a805d4172826a96b1e90ec2285002a3f30ad1289a

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            111B

                            MD5

                            285252a2f6327d41eab203dc2f402c67

                            SHA1

                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                            SHA256

                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                            SHA512

                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            89461ab76f816b8d53fcd440957f36db

                            SHA1

                            cd4d494fbcbf91f9623da2f246f4bf660c243e95

                            SHA256

                            603c53c0aeb866b5019a1ef2893016d85da222599c571757a622434446ee6fa9

                            SHA512

                            260bb62444316c87ac3dd4f5a9659cc0bf6cd87836d526bd13cacff1f8c7e272ad1f68c3d756ea6f547d16ca3fe24622e7d2971bba43e2e801c37e3d4d7fc135

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            ea0b488401ea7846f0b181847e4ab428

                            SHA1

                            fa0be68120197cbd634d34a94c325fc7a22bf5c8

                            SHA256

                            f200cf0a35ab6bbb7d1f23368d6d3ef76b3b6569cfa912ebd12ce8ad763f1e04

                            SHA512

                            c6b724c29c9deb49819dfd6ef897da89472d066e565974902353b4571f3cb7c4c06695c97aa8d58c8f85a3a9801342bc062ff3e49d5301922633ccaa84193999

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            5d0c76e596d00b297f6649b0cb706cd2

                            SHA1

                            c2e537f458ee4c5c290f24cbfbaa940b642802dd

                            SHA256

                            5f665925c455180c4bcead91d41c298d9689b7dc73a77369f66d1e9bf52c3aea

                            SHA512

                            7090c3523051d03aa1cacadc3f3713d0e0dc43e2c252e6754d83826af3d58095600977875ff69ce0b5f825a52ad3562568eec34745109692850029e81a7cde40

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            16454ec61028772a1ebea0210d19d7d6

                            SHA1

                            3c10b73877aaa1d04013ccbf77101d617c93f573

                            SHA256

                            77dee9080d5a8e954fbca6c760c59220c80b60dc2cf5bffc8231efd0fc2d193d

                            SHA512

                            d87f7b23e240428fd69a2195a1e7320e357c7dd84d5c9352a365544b2258555142fe56a57be259d7c9ee15ac5c996999ee17bafcc69e902559f8a1cf0bafb0ab

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                            Filesize

                            24KB

                            MD5

                            e2565e589c9c038c551766400aefc665

                            SHA1

                            77893bb0d295c2737e31a3f539572367c946ab27

                            SHA256

                            172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80

                            SHA512

                            5a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            84d1d6f444afdaf26f90af3944b0f83e

                            SHA1

                            098ec4ecc375227b444355ff4380a7fc3911f00d

                            SHA256

                            5a90e1a5e0a0e4ff491bb1cfa7ea822fedeed3c36373840254abe35255a6fbe3

                            SHA512

                            d6a76a64960deae0bb28ead7d90c5a95de8ec44fe0bd48ed2aa5199cc5fe488307c7050deeaa01a3fbd32de466295fadbaf643a873a13aced15298fc951fc048