Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

URLScan

urlscan

https://gist.github....

windows10-1703-x64

4

Resubmissions

04/02/2024, 13:23

240204-qm6f9achhj 1

04/02/2024, 13:18

240204-qkf4kscghk 4

04/02/2024, 13:13

240204-qf259aadd7 4

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/02/2024, 13:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://gist.github.com/gitlover10258895656/96fca26121a1d4e3cba45cd705394a1d/archive/eaeea7b267e3195dfec73d4046fa3c35e626e299.zip

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://gist.github.com/gitlover10258895656/96fca26121a1d4e3cba45cd705394a1d/archive/eaeea7b267e3195dfec73d4046fa3c35e626e299.zip"
    1⤵
      PID:216
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1132
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:4284
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:608
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4536
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4496
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3276
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2512
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\96fca26121a1d4e3cba45cd705394a1d-eaeea7b267e3195dfec73d4046fa3c35e626e299\step1.bat"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:792
        • C:\Windows\system32\net.exe
          net session
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3292
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            3⤵
              PID:4792
          • C:\Windows\system32\reg.exe
            reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d c:\step2.bat
            2⤵
              PID:4412
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Windows\system32\net.exe
              net session
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3064
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                3⤵
                  PID:208
              • C:\Windows\system32\reg.exe
                reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d c:\step2.bat
                2⤵
                  PID:1844

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6NB6O71M\edgecompatviewlist[1].xml
                Filesize

                74KB

                MD5

                d4fc49dc14f63895d997fa4940f24378

                SHA1

                3efb1437a7c5e46034147cbbc8db017c69d02c31

                SHA256

                853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                SHA512

                cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\78MB6DNM\suggestions[1].en-US
                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RBLJI3D1\96fca26121a1d4e3cba45cd705394a1d-eaeea7b267e3195dfec73d4046fa3c35e626e299[1].zip
                Filesize

                1KB

                MD5

                bf257f02ce0e9a2eba3ef3659eca1f5f

                SHA1

                83c2a7397cb4d7a95bbb4d0d9bad6a9619999847

                SHA256

                0d5b9bea3e0dd8494ee9d54906958634b528d1c478616cd639219caa940867c8

                SHA512

                aff34415592506b6ae6cf1aa1e1bcdbb107687732bca93bc12c57be0535a1bf51d7d79d58316f3205296af2bfd3bc988f4b606a8d9cfc87ae27fbc43dd902ac7

                Download Submit

              • memory/1132-0-0x000001E0FFE20000-0x000001E0FFE30000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1132-16-0x000001E082100000-0x000001E082110000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1132-35-0x000001E082340000-0x000001E082342000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1132-117-0x000001E088EE0000-0x000001E088EE1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1132-116-0x000001E088ED0000-0x000001E088ED1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4496-62-0x00000254B5560000-0x00000254B5562000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4496-66-0x00000254B5590000-0x00000254B5592000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4496-68-0x00000254B55B0000-0x00000254B55B2000-memory.dmp

                Filesize

                8KB

                Download