Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

URLScan

urlscan

https://gist.github....

windows10-1703-x64

4

Resubmissions

04/02/2024, 13:23

240204-qm6f9achhj 1

04/02/2024, 13:18

240204-qkf4kscghk 4

04/02/2024, 13:13

240204-qf259aadd7 4

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/02/2024, 13:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://gist.github.com/gitlover10258895656/96fca26121a1d4e3cba45cd705394a1d/archive/eaeea7b267e3195dfec73d4046fa3c35e626e299.zip

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://gist.github.com/gitlover10258895656/96fca26121a1d4e3cba45cd705394a1d/archive/eaeea7b267e3195dfec73d4046fa3c35e626e299.zip"
    1⤵
      PID:5048
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1112
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:1248
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4504
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4424
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2812
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4940
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:32
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3708
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Windows\system32\net.exe
          net session
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            3⤵
              PID:4364
          • C:\Windows\system32\reg.exe
            reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d c:\step2.bat
            2⤵
              PID:4124
            • C:\Windows\system32\net.exe
              net session
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3528
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                3⤵
                  PID:5100
              • C:\Windows\system32\net.exe
                net session
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4652
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 session
                  3⤵
                    PID:1552

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6NB6O71M\edgecompatviewlist[1].xml
                Filesize

                74KB

                MD5

                d4fc49dc14f63895d997fa4940f24378

                SHA1

                3efb1437a7c5e46034147cbbc8db017c69d02c31

                SHA256

                853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                SHA512

                cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\U2AKE964\suggestions[1].en-US
                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\29ZG9A2F\96fca26121a1d4e3cba45cd705394a1d-eaeea7b267e3195dfec73d4046fa3c35e626e299[1].zip
                Filesize

                1KB

                MD5

                bf257f02ce0e9a2eba3ef3659eca1f5f

                SHA1

                83c2a7397cb4d7a95bbb4d0d9bad6a9619999847

                SHA256

                0d5b9bea3e0dd8494ee9d54906958634b528d1c478616cd639219caa940867c8

                SHA512

                aff34415592506b6ae6cf1aa1e1bcdbb107687732bca93bc12c57be0535a1bf51d7d79d58316f3205296af2bfd3bc988f4b606a8d9cfc87ae27fbc43dd902ac7

                Download Submit

              • memory/1112-0-0x000001F56B820000-0x000001F56B830000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1112-16-0x000001F56C100000-0x000001F56C110000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1112-35-0x000001F56B9E0000-0x000001F56B9E2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1112-105-0x000001F572B00000-0x000001F572B01000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1112-104-0x000001F572AF0000-0x000001F572AF1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4940-69-0x000001D25F420000-0x000001D25F422000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4940-72-0x000001D25F450000-0x000001D25F452000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4940-74-0x000001D25F470000-0x000001D25F472000-memory.dmp

                Filesize

                8KB

                Download