Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/01/2024, 03:39

240101-d7284sdfc7 1

01/01/2024, 03:35

240101-d5fx4adeh2 4

01/01/2024, 03:19

240101-dvanbsddc8 1

31/12/2023, 02:24

231231-cvqtwaegdr 1

31/12/2023, 02:21

231231-cs7dvaedfl 1

31/12/2023, 02:01

231231-cfzhgadcf2 1

31/12/2023, 02:01

231231-cfywyadce8 1

31/12/2023, 01:24

231231-bsgmraffb3 1

31/12/2023, 01:19

231231-bpzn6afbe2 1

31/12/2023, 01:04

231231-be39ladfc2 1

Analysis

  • max time kernel
    0s
  • max time network
    1218s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/01/2024, 03:35

General

  • Target

    http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "http:///search?q=reflection+nebula&rlz=1CAKLUN_enGB1063&oq=&gs_lcrp=EgZjaHJvbWUqCQgFEEUYOxjCAzIJCAAQRRg7GMIDMgkIARBFGDsYwgMyCQgCEEUYOxjCAzIJCAMQRRg7GMIDMgkIBBBFGDsYwgMyCQgFEEUYOxjCAzIJCAYQRRg7GMIDMgkIBxBFGDsYwgPSAQsyODE5NDAzajBqN6gCCLACAQ&sourceid=chrome&ie=UTF-8&safe=active&ssui=on"
    1⤵
      PID:2976
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1264
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
        PID:1876
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
          PID:2772
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
            PID:2020
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
              PID:2332
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
                PID:520

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1264-16-0x0000015C0E420000-0x0000015C0E430000-memory.dmp

                Filesize

                64KB

              • memory/1264-0-0x0000015C0E320000-0x0000015C0E330000-memory.dmp

                Filesize

                64KB

              • memory/1264-35-0x0000015C0D5B0000-0x0000015C0D5B2000-memory.dmp

                Filesize

                8KB

              • memory/1264-84-0x0000015C152B0000-0x0000015C152B1000-memory.dmp

                Filesize

                4KB

              • memory/1264-85-0x0000015C152C0000-0x0000015C152C1000-memory.dmp

                Filesize

                4KB

              • memory/2332-65-0x000001FB6E4C0000-0x000001FB6E4C2000-memory.dmp

                Filesize

                8KB

              • memory/2332-63-0x000001FB6E4A0000-0x000001FB6E4A2000-memory.dmp

                Filesize

                8KB

              • memory/2332-61-0x000001FB6E2E0000-0x000001FB6E2E2000-memory.dmp

                Filesize

                8KB

              • memory/2332-59-0x000001FB6E2C0000-0x000001FB6E2C2000-memory.dmp

                Filesize

                8KB

              • memory/2332-57-0x000001FB6E2A0000-0x000001FB6E2A2000-memory.dmp

                Filesize

                8KB

              • memory/2332-55-0x000001FB6E280000-0x000001FB6E282000-memory.dmp

                Filesize

                8KB