Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 16:59

General

  • Target

    https://m.facebook.com/209687782184897

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://m.facebook.com/209687782184897
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffdbdb346f8,0x7ffdbdb34708,0x7ffdbdb34718
      2⤵
        PID:3824
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2696
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
        2⤵
          PID:4820
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
          2⤵
            PID:776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
            2⤵
              PID:4396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
              2⤵
                PID:3856
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
                2⤵
                  PID:3540
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                  2⤵
                    PID:2296
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3260
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                    2⤵
                      PID:4176
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
                      2⤵
                        PID:1756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                        2⤵
                          PID:2024
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,42029227857173681,17947714703838855203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
                          2⤵
                            PID:1864
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:772
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:264

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              208a234643c411e1b919e904ee20115e

                              SHA1

                              400b6e6860953f981bfe4716c345b797ed5b2b5b

                              SHA256

                              af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

                              SHA512

                              2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              672B

                              MD5

                              5c5aa2e4554bfed1be1b8a4cfa7f900e

                              SHA1

                              67c58d62312912aaed15cc5b8778a2e532d9b98b

                              SHA256

                              b447d2ab1662eab9b620b03080ce2ba218ce675f14737fb5d71031d08642b61f

                              SHA512

                              da2ffa3b005370cbb2f1adc72843d282bb51c9f12dc50c73cc55de0b2729123a165cfbc297bc78ba0c8d70d61ecb84d9473b4ace1d0664028be2ac45ae150214

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              400B

                              MD5

                              a1f1bf86f595d43611b0bac6f73f8613

                              SHA1

                              cf9beac8467d3068617a1163bacc3b322c2b8d18

                              SHA256

                              459c5ca37048ba6846ea9570b3457f1849a3918079ff1158fc4451994cc5ac41

                              SHA512

                              956853d46779ebf230328b9a6d443189a810051382d6701218cb7edece9dd1f2b0f2c1602aeb34f040f5cbd57a0f7f74384227792f31316575a40fe6dc1289eb

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              36cca14e07d15bcf3dcde44c451bd6a9

                              SHA1

                              99df5161b4b87950c288e89bca104347d93e2faa

                              SHA256

                              8d2f07b3a3d6721fd43786b7eb8c4e9d02a5a5217ae50f1d573bffc8aee313b9

                              SHA512

                              e8aa36790e31364b4f02896d44ff755dd142179cf3ba1ceecaba28e30c3afe228a128a66085a2cee62ba42ec9f96d78260e798f9eb589be1e846dcf3961ce701

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              81464223bba937f1fc452a1b394f06c5

                              SHA1

                              288dc1cd93bc6695583b996d8ee0da1dac253771

                              SHA256

                              c6f06ff963e905945b877d9aab970bb0a1b7cc08c869ca5d4630a5070bde5e01

                              SHA512

                              94ae9b560ac28067f5663466fc2ed5edb6e8949f236df358f24f547242153dfb0c6b402e32e5e7d002f6f808730fdb36d35611f4a788fafe9cef92631ec23e79

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                              Filesize

                              24KB

                              MD5

                              5a6206a3489650bf4a9c3ce44a428126

                              SHA1

                              3137a909ef8b098687ec536c57caa1bacc77224b

                              SHA256

                              0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

                              SHA512

                              980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              872B

                              MD5

                              d5db4645d3fece1df235f6b9be685e6e

                              SHA1

                              2983eea6f9658fad7ccdf5539695805b7ce4164d

                              SHA256

                              a0eb713d5adbfbdb81e5a656439c5d1615968ad9eacf191bdb3c4320b891326c

                              SHA512

                              0a0e2bcecc5ea1b3903c278f9941c3f8699c42968a67d69d861308d8aaaa320f8a0ab5c838637aa50ac1d452e8e02fcac9a9565730885b68081f121884967d2f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              872B

                              MD5

                              c3dfbf779b7b4e42914ac02f21012c50

                              SHA1

                              20e20bf5f558dfed6164ab6c1e5e3e8c402b0316

                              SHA256

                              fae5a98a565ac5c0b23bc302b02473dbde9186c75d39a60462b5177751ccd1e5

                              SHA512

                              ef14f9998bebdcdaf206a0836f709a487cc28c6016cac24b45083771e0e239aadd6f67d65b7ed961694f188a343ee2cb280a25a497eeb67b7479ec9ed5ec4927

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb3d.TMP

                              Filesize

                              872B

                              MD5

                              d93649cba768e79401e07a335671df04

                              SHA1

                              8f9c4a53e0bbc4461cd7e5f980a5422092ac8aca

                              SHA256

                              e0ef2b5b5facd56a06a25f38376053deb6de85955278a63474d32fe17747f43c

                              SHA512

                              e192e3793449b236813e0b1fa86fea30bf81f27cbe2dc73e78fb94e133bac656ad0ec2b057bec1413014d07d024ec995b37755f2d72fbecd51537fb4157f1fcf

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba4cd4ca-3686-438c-a8a2-bc1d0f7285a6.tmp

                              Filesize

                              872B

                              MD5

                              d0a19b20ec6bdffef461309dcd65cd49

                              SHA1

                              ff8bc8e94be60c07a4920fb271f9620865706ee7

                              SHA256

                              0e3ab678d59c51463ea86ff3434fe5b8899ce21f1af2efd8f04fddf73d7a58f5

                              SHA512

                              9d4718d2f4e2d759416d448c4bc6a7aabb46d578c5cc70c6623b6f5b54971fbdeff960dac3aea8c05bbf71225caa5c6f05910ae3cc66a8fb72988ec0f21a3100

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              cf4a99e4f14b88d4c856fb8617bf0375

                              SHA1

                              1ace15a2535b93a7b38de28e140f6bf66d4113a8

                              SHA256

                              a82a1c5a6a36db24f669e454e0cb73a7cfe9f9eaf19dc6a5695fd0cfbb9dc1be

                              SHA512

                              75fc2c7d379fadc8ae14a91ae016d7f68d5fafccef720310b46683a1d8f6fd57445ba3fb8cd2b8533c97c7deb123c786dc8cc8ae1b4e9bf9a77370ed17527c4d