Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 17:51
General
-
Target
Kiwi X External/Kiwi X External.exe
-
Size
321KB
-
MD5
5cffeb50ea761647c2793266a214d1ea
-
SHA1
3e6cd4887f640dce3aa69087eaf494bf7fa2dc38
-
SHA256
a21347fce750661ac8c4c9ec2c764e189471ce407ed4810484041c7eb02fcd29
-
SHA512
fc4791229d987d9455687cd2c1474ca053ef676cb0d17d7941a7cce3033d45e2a4dc598244ffd86ef74b111a37e9d03407901e2b67fe00d38db6dba6b7d9530c
-
SSDEEP
3072:JIl9mTYDNDK36o4zEsb3q3BIIi4bZIYl/I8ZNmKrGqx:JIvK36o44QadTWYl/IKNmKr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe"C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac27446f8,0x7ffac2744708,0x7ffac27447183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8433423299532762982,9234416460627508340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:13⤵
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e71d66ce903fcba6050e4b99b624fa7
SHA1139d274762405b422eab698da8cc85f405922de5
SHA25653b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA51217e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
-
Filesize
360B
MD5e754b977990efb2ab7e87b4cb918fce3
SHA19fe3c7b5b2582480f501268cdccb0750eb9fa0e7
SHA25662518d2bf63515a9cc6b1025c970020750f80256c8508eef5792bf539dbba510
SHA512adcaaabeea56865d909e6b69eb52f2d3062a1d6b9e820208df6e4e0206ae3b4dd833985d936f458cb36915a702633c92f6ae7907424e3cef2a70cbddd8943f6b
-
Filesize
909B
MD53c91f4a841ef180b3cc6807b48055dfd
SHA1aff8dea6c6dfe0dde40a605081ddefdcc8817c82
SHA256ad5ff4cdb32a083314acc07a310532a487ef4804a88f09851c563dde813df382
SHA512b8725da98e0c51a7940b1bf42eb2b3afc109993fc340770d5660690239e00a4f88753bb092147d813a71f392ee6eee70e2928e1cc0b8f81d13e632193f725ee4
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5f78ba1910b20e4b6de7bdd8dd5744d03
SHA193805262a9e4b1d464f1a6f392bf417301dd2511
SHA256ae540607dda79c53ae0005e24a9651459d5e9ec9a7ca3297a3bd6f3b1767978e
SHA51222c03a973abcaf67dfde4cd65b936a30c0b2348387540f2a51a8640c002e8d160d2e078e26e2fe81326f03508b3eafe7a4e5bcfd0f162710bccedb06c58688ea
-
Filesize
5KB
MD5932dcfeb3f9b2cb1a3130b02751460c5
SHA103f78518441a28db831ca5f005a3f14d092323a5
SHA256606ee7a2bffc49da2ee79be0c3b825776d505a51317c81edb163eac9f33c9c3b
SHA512ad90078f2eae2432906900ad5319720a776dd2cd1feadbada403a73df16110bc8030bf58846053849482b93a6d547c2ba6f521b74f65632f68a23179d8c66ef0
-
Filesize
24KB
MD51b1b142e24215f033793d1311e24f6e6
SHA174e23cffbf03f3f0c430e6f4481e740c55a48587
SHA2563dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
SHA512a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
-
Filesize
707B
MD5987476af6b261c9e325752567c1496e6
SHA14649d450c353e72e4926d8de6ab39256a8bcf023
SHA2562d5f97bc2d51bd9992e821d7b58929c45083a4449d62fa3bb797c019f9a4ae8b
SHA512371a9fc26e11bed5ced32b18b6f921ba9586e50c8cb64297ae401012aad92f4acb3df7ef1a68fae2aa26bb1b54618395dcdafcd8844b815ed15e0708ed33a6cb
-
Filesize
707B
MD51a460616b7c64e69fe04de8632db2a15
SHA17b9407c2ab4aeb5d6f47ac92c9dcd33c5fd2a006
SHA256ebe673fee6ec35343b4dbf7aaa6b0f21890f7513a46bd5fea272fe82113f7203
SHA512e4ba55c13427bc2de9a54ef395029b855099f0b156ac3284c723a9c69f99561bb343241a02296d7d2d92531eda2689deaad3e15a4374892f05a8cdb43bfb85fc
-
Filesize
539B
MD59612e1bf92f5f42c8e5466b5b749c3fe
SHA1b4604847badbea0966bec9f00de6e44e5d31a83c
SHA2565221a499646465db4e688d842067487dc8cf153c7bd5d586e8750446f3e2f3aa
SHA5128e046fa13f51ffab3ae6db7965e8c7beb63337e4b427ced312f4f1638c1a3014247eb1d298c70f81dc2bf0617e183ccd925d87ed714bda5de6c2383f3eef785c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a96b45a36113f387815328bcda57cf4b
SHA1fc6a0d8e30559306b81dbe6bd350219c7599d277
SHA256f4cd55ec3e3eadcc34a0cf4c077debb4b8823f2a8189bb677b4a4d64dd8a3caa
SHA5123430e5bd6ae9652cb915be41571449b01d8d733bde83d9ab78ee81f17bc4769e5710d4909d7e8c6eb9dc97e2fcfa47e997ec44a37b14591ce49bdafe4bedf932