Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 21:15

General

  • Target

    1295bd2ba472dc2175049b89a3bd9986.exe

  • Size

    14KB

  • MD5

    1295bd2ba472dc2175049b89a3bd9986

  • SHA1

    3f7788d5beae74893d9f1ea2db817803503e44a1

  • SHA256

    e3df98b51d861e3b63fec904f84e269c01499c403aa536f9ad2ad4dc1da0e5e8

  • SHA512

    80788ed9c22ad1f53fb4c478baba800846bdd8328e964f1be6345131023e0e0bfc8203555df69fdd9ff382e0d9369634fe08167d350611a2dfa659620104e3e7

  • SSDEEP

    192:nlUC461A/0LiQxqfKD6VkagfWhiQ7SMrZQl96Sd/Cv+OHLQjcWFDZgmC:lUFx0iQxqslQm39b/QRLAzFDZgmC

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1295bd2ba472dc2175049b89a3bd9986.exe
    "C:\Users\Admin\AppData\Local\Temp\1295bd2ba472dc2175049b89a3bd9986.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com.br/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
        3⤵
          PID:4776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
          3⤵
            PID:3088
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            3⤵
              PID:1808
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
              3⤵
                PID:628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                3⤵
                  PID:2632
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3984
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                  3⤵
                    PID:2928
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                    3⤵
                      PID:4928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                      3⤵
                        PID:1032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                        3⤵
                          PID:3736
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
                          3⤵
                            PID:2552
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,860633989760120725,3514589929404002114,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2536
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3b1a46f8,0x7ffc3b1a4708,0x7ffc3b1a4718
                        1⤵
                          PID:1012
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4632
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4168
                            • C:\Windows\System32\sihclient.exe
                              C:\Windows\System32\sihclient.exe /cv cArtOXQLuU+cK7Cqt8GxBQ.0.1
                              1⤵
                                PID:1032

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                1386433ecc349475d39fb1e4f9e149a0

                                SHA1

                                f04f71ac77cb30f1d04fd16d42852322a8b2680f

                                SHA256

                                a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

                                SHA512

                                fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                192B

                                MD5

                                ad6d1bdb24dd919c2a059a7ae58f9cf0

                                SHA1

                                7643eda33c4f4c9b8ad5799731ec9f48c09b3d13

                                SHA256

                                55cfc06706cdf96c951a024d0cad85720f7987457337bc0dc589a1dd8a18c453

                                SHA512

                                97d7aadf85288d66277afab539519d55589414a8ded05123a844e67b402018de595d693330b0ef8bd1fb0471abe2f1b469585c50903f3c6b7938348ee76550a4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                981B

                                MD5

                                1639abfa651c37cfdcde499aec6393b8

                                SHA1

                                c0eebacb7e700148e43db171e84e0eda814628e0

                                SHA256

                                760a7b30cb4ecb4058d4acfbbffb88746fc9fc595b354eff6b047dae13aac1c6

                                SHA512

                                481c1de86e6053a09c9d8e77b1d0f88ea4c0fe5969b1a6f02b3ec55c897677803e6f7df53ce7057aff37df1ea8007160dfbb2a0f08c79ae8f08ad2de79fa680e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                5387735ce37389e629f37f79a72167c0

                                SHA1

                                4e4ff4b9eab4654629382642b9ca0845eb25b40b

                                SHA256

                                cf451281a90f811e261ac9ca5ccf2b6db3180967236963eb9a03c51407d7cab0

                                SHA512

                                d5ee386af37b7dfb9587bccfbc8875249084b7432b0f269fcf67f86f12a2f48b6b9894fc1bca302e8a58968f449a1f17565304b7db684d3fb8a13a1b7a267335

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                d82853230eaddefaca6c4c5aee693e33

                                SHA1

                                a78e37b073bb02e728d7564dc69de3a9b14b9ecb

                                SHA256

                                87f2c15f8788533bb9c566c48d617bf928268985d1e04582182123b08054ef24

                                SHA512

                                7ee89b76173c6e6fb6658df0673d1c692ae5c690a7382d277e015c7d79c7da0ee1d5e79236a6f84da6b17cf55910f752e37754c8da66362020b96a8581ce7c94

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                Filesize

                                24KB

                                MD5

                                e664066e3aa135f185ed1c194b9fa1f8

                                SHA1

                                358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

                                SHA256

                                86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

                                SHA512

                                58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                e514eaa1b0fce0b24ce23a86417ec52d

                                SHA1

                                a3d5e35ecdc42b11b3d7c7e4f5bd8441a0985836

                                SHA256

                                ef4db65fd90efe433b6db6a499ecb14a09ef15ce1e28d5d717c6bca10f0363b4

                                SHA512

                                315e06a99666bbe9027ef327bb1d6d5f654118ba422991fc8a4e6b082cfbdde4d70672f5672c3eb51bd793b7a3d6e47d2110b7a6a082fbe51847f77aa2c0c9e3

                              • memory/1540-0-0x0000000000400000-0x000000000040B000-memory.dmp

                                Filesize

                                44KB