Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/01/2024, 05:35

240112-gactqsgcf6 7

12/01/2024, 05:30

240112-f7lx8sfdbm 7

12/01/2024, 05:25

240112-f4aqssfcej 7

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/01/2024, 05:35

General

  • Target

    huiziyuan.net.url

  • Size

    125B

  • MD5

    c5c2781c90eb13703b02246f554e4467

  • SHA1

    e36784119e6555bf3c9bb8794fdeb1d2de2a2963

  • SHA256

    e20696365d2876ba2aa7abdca6e0830c5e183121105a8b68cf412c4ec427ad77

  • SHA512

    7fd1703843c9fd55ab08b681ad8e9ee8d6796eee54438ce7a8b16f042b11822032f9e2d69f658a043792f41436366542d0c08d31e802299385647abf862fe716

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\huiziyuan.net.url
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.huiziyuan.net/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd1723cb8,0x7ffcd1723cc8,0x7ffcd1723cd8
        3⤵
          PID:4076
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
          3⤵
            PID:2044
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1452
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
            3⤵
              PID:4124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              3⤵
                PID:4888
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                3⤵
                  PID:1968
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3716
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                  3⤵
                    PID:3432
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
                    3⤵
                      PID:2228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                      3⤵
                        PID:4720
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                        3⤵
                          PID:664
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2436
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,14524365194798171454,10771437766018023568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2152 /prefetch:2
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3068
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:1704
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4024

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          b09c5d9d170124cc803af2dd5f23e2b4

                          SHA1

                          41a3ddbafd6f3062f07ec162679bfab95fd88482

                          SHA256

                          5e6d5fcfb3805ecd4d9388837551cc02c5452f03cddba1b29b23fd02686befd8

                          SHA512

                          8fd1752211ec074f85d0ee59f39bea6e639199602d71ec947940575a9c515dda96b1eed5af10d513e21373f64a6d03146bb3251aa690830110ff4c6c486b4036

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          600B

                          MD5

                          e48a65ced502e8dbab8382ee73cdbe9a

                          SHA1

                          b69c615d96304dfa6933525c2bd97fc64b622eff

                          SHA256

                          8705c5600ad177a542ff99d085b9732c0907c77eed5113137d124671bde76292

                          SHA512

                          2c9e427e676c1c6175066178d236a2dc97065c8beba29d903251c8241c56a4f357eecfe3d7b1ffc96eec05467252dbe921bc2f168956a1074adcc7b0d5e576ab

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                          Filesize

                          111B

                          MD5

                          285252a2f6327d41eab203dc2f402c67

                          SHA1

                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                          SHA256

                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                          SHA512

                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                          Filesize

                          111B

                          MD5

                          807419ca9a4734feaf8d8563a003b048

                          SHA1

                          a723c7d60a65886ffa068711f1e900ccc85922a6

                          SHA256

                          aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                          SHA512

                          f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                          Filesize

                          399B

                          MD5

                          dee1f0c8f8f437af637b58416991d5e8

                          SHA1

                          b324c1c86b1f3422b39e428eb343355d60679720

                          SHA256

                          a04c0e49877aa7922f39e2cb9474e6337a8e9d11e7aa640fe427481296d94491

                          SHA512

                          2f2edf808136a1f8ca5b8b73d269d7c30d58affb2fd3c3cb3b2d227b9065bd3150cb28d441fe9fef97c25c5407001eef9182a24a06354d43835920e2834daddb

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          5246546d65f9a268a3fec1cec74af1a9

                          SHA1

                          657921604896c2f5a4d5252a4154a291263af1de

                          SHA256

                          27a0f0a0c54c0837fc0653800ef24a528ccf06ae171990dd0526209729c8c377

                          SHA512

                          ae992b10d9cd91faeb9e7ee1212665d94c5adb8e4b372fe90465041ad74276835a7026e4cd99081058ee7b831e95365a59a7d204c7d1584a8802672829cabea6

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          07e9ac95d0cf3d860fab3d04f3ae9cbd

                          SHA1

                          f6cec6e068c819fe2e447315b5403fd96815ef30

                          SHA256

                          01055a5d88fdaf2a272a5f90edba3a5fb3ef9da9f8c7f0220d7b9c9799db7c18

                          SHA512

                          a25d2810d720c78d4cfb38687f073c7a56ee4bac6372b8224bafa7f28b0350341e039f258a226cf221b03484072146780f3625be386b83ba23870654a43c1c52

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          e5f532962fc8e84e2a5749f6b7411e97

                          SHA1

                          0fb614f90378b973cf5c261d276842cd1d5b7a99

                          SHA256

                          e5b849a56075ff94ef83c8f804349f54a257c47bee0ca6bbcd7bf7d1308df58b

                          SHA512

                          76e7f5de04aa0a26c7def87d00ba6d3cb23bd2af38464684da6ec47b6c6e5b3b1a39f92d433af27a2d0ed81abcb1a6ff3363414dac6d29c4a479fb5b87496703

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          a6e55e1f7f402c77d4eb93453134a263

                          SHA1

                          369270d0ac7b1eabd217c587321828f3e7930812

                          SHA256

                          df977dc80e249f4e0c0817bacc1600d9d7e27ed988dfc8a83e331af1e66a217c

                          SHA512

                          6536e0a68ec296b877b4a01c0805ac3578a76496df4461ca7b4c9ba0d4350e86f0ff3a938f452769b976d8985ad9c238a233b31b982327a7f1374da75b3ba95a

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          d2ac81186addd3f6871fb5b3868ea3e6

                          SHA1

                          c601c6b38f40c648349e5b5cf09d3d2d31a2f6a7

                          SHA256

                          5172b0e8f978682ec664bbd76e9bb42f788c8d1f92d8cea0ec195a6e21c6198b

                          SHA512

                          56b9a8347077ca78a56bdf754e53927437e649d9107c5ec1443e4206b1962b9a6dc0c03f6935f8bbf7c56b2721fff0a2e938b7590d539da25dca513966d3b1c6

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                          Filesize

                          25KB

                          MD5

                          c7092e044a47c593ef643da75dc6a456

                          SHA1

                          80e8bca84e362de86a7332742a62834ba887deb4

                          SHA256

                          18ac390cf8b5d7c5ceb90ce5e744deedc18be8e33c84e214bb64fbffd0686751

                          SHA512

                          b93ed015737a477a735c03e0cc884d746444d081dbb24d542ebbfbc2d30a5101799d2564733780091f28bf84adc3c7b2eadc265cb6bad6f26080abf63e0f085f

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                          Filesize

                          540B

                          MD5

                          c464f0d2ea459619eac979f65b9a3182

                          SHA1

                          7c02d996ae29ea7cc77f2af1fa88fca216a76acf

                          SHA256

                          ca179d20c15ac38da27b495ee875908984567f898151290c10b8232dbf2a9c5c

                          SHA512

                          0dbb9bd236b4238480613e41b3a8fdaa25c0568d61f520506a6c5e037b3f1a1249d810717c1e16520c9421646704f5afd7784624ba27bcc9dfab5ba8646f9196

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                          Filesize

                          540B

                          MD5

                          90f0a93229b4fb9ac00c0382546ac53a

                          SHA1

                          e37c7ce15f5e1d70de3d60a472a261a0f2c19786

                          SHA256

                          5e425da0a5dd135f1b57fa09ca2a46b7cec1472b894bc22bfe69d0ab56cb1005

                          SHA512

                          8b30757206f41948fd1200c9fdea687bb12085acdd6abfc1db3a231e5fe83519a71e64e85691cb912ee8892e777d0225df99d5ffee602ec3620509461bc912fd

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583321.TMP

                          Filesize

                          204B

                          MD5

                          e5aca78d9d2fa566a95b961322a16eb2

                          SHA1

                          9251e989d38750785eac725e1faef612f7f595fa

                          SHA256

                          8d3345742a8eeb4017e85ad0b3a2448200a4ec04330c8ac7d91f53018c1c96f5

                          SHA512

                          1b8f36a7370f3e587364fba70aa18fa8c764e13d3339e3809137e6e7b3fa0c7a4ac963029c9e077d21bde893c4252490c651bfc75ff73701b0c5153cacf26193

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          6752a1d65b201c13b62ea44016eb221f

                          SHA1

                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                          SHA256

                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                          SHA512

                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                          Filesize

                          10KB

                          MD5

                          2db4eee111c9204ac3a55edead19d82e

                          SHA1

                          521133b3d69cc15c428cfeb4cdf1d593dbec129f

                          SHA256

                          573bc56edcda736e0f4a4e689e556f1a38976d376cf8a60785afa55d63a45e1d

                          SHA512

                          04ff0d5629cddd6493e680136a5b76593b5f0c39745d0549363fc576806fdfbf8b13b0beb85f9a74272b10e0d95917ab902f99bd53bf53c5b4fc7a8696336e37

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                          Filesize

                          10KB

                          MD5

                          31b2ca93824e8a3489424422cebd552e

                          SHA1

                          49ae24087a1bb0cc84c7c2c83d9078f61d465035

                          SHA256

                          1a6c7738ab85e480d05b0ef398a763fe2ed03a2b878fb37d4f5f57d89f975a2a

                          SHA512

                          1268e3aabc2a458f6c9dd2d01c8e6ca3c09c9916a0637c9dc191d77869ae10ca2efbf25b232d10b3bf2c7277cd40f7d7d75d076780de6bd1e3cd968ddd12206d