Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1680s
  • max time network
    1685s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 10:02

General

  • Target

    https://www.mediafire.com/folder/moe97b0px6mqc

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/moe97b0px6mqc
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9f6846f8,0x7ffa9f684708,0x7ffa9f684718
      2⤵
        PID:3032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:728
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3552
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
          2⤵
            PID:2008
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:2012
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
              2⤵
                PID:208
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                2⤵
                  PID:4432
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4104
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
                  2⤵
                    PID:4864
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                    2⤵
                      PID:1524
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                      2⤵
                        PID:4504
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                        2⤵
                          PID:4716
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5111608027407371289,5366878875923283340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3216
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1944
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:5020
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                            1⤵
                              PID:2200
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4780

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                              Filesize

                              16KB

                              MD5

                              862e7033212bfac323dd3cb876692024

                              SHA1

                              18ac026f4bd778f22246b773634aaf988692e887

                              SHA256

                              ee99f58e33e03ec831d170d1e48f29f585cee8966f47e6e078ae80590a7c1f86

                              SHA512

                              695120d91ae21468bda0c237daa00d831dcfd4773823aa363b261eb0c576392227ba86713974b77b9c408aa936ae6c9f00540c4266596e73a07f4ffaf138e7f2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              f246cc2c0e84109806d24fcf52bd0672

                              SHA1

                              8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

                              SHA256

                              0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

                              SHA512

                              dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              432B

                              MD5

                              80ca25ee948eb90553e5c9e6970be0ce

                              SHA1

                              bc6744b44e062c10a530a590ae48ad924a2c9ebe

                              SHA256

                              fc428691d75eb41fcf429910e0363c2887b934f57fa2422c0ea7cecf0736b291

                              SHA512

                              eb694f8d20a93c9f8b455653ad3e921390f5e665454e0b6abee4b01fa237f203acec580ee6f36f881f5e25202cde76fe2a65a2e8ed79144aecf67fe2150759f2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              416aa2c52675fc8009af749a479134b9

                              SHA1

                              b2f7a8abae4e85198e1b3ab9a8e3f9d29f05dbbd

                              SHA256

                              dd6f320fa0906304ddc2242ef60b8222865efb52a8c80832d978882306f4a3e5

                              SHA512

                              306c37bdbd704037a49f45166e62bae0fd951c12a7afecc5e790132d0918d6e2d372e9763ae62ecf24bc2ddfff62bc1e60c03df0d37f8de124f5e8bd64473123

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              285252a2f6327d41eab203dc2f402c67

                              SHA1

                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                              SHA256

                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                              SHA512

                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              ed1b744383d866f88d0791712d9b0ad0

                              SHA1

                              3b444ab2dc94c2a43c9056d11ff15d4d5e138a56

                              SHA256

                              1339191bf2bc318577211dbc9262d215e2b116bc2e23cfe9a7f7d03e8168488d

                              SHA512

                              aecb320cb060b3d67e3c9219a0da31549fa4673e612bba226e82b3cd91bef94b952fb1ce75b4dbf4ee4e28e4672d66b256235d9e59114e0cdda29e72bee6804f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              c023c4894bb057cfb0a5a9840f47d44f

                              SHA1

                              3af92fc3176cd7bd35ea47a61e4d355de87f0f42

                              SHA256

                              3ee6090445e26e5671fbf6143b586708646ed550c3aa656d4416fdf5c8e30ae6

                              SHA512

                              dfb0d00dcdda11b3d0d0b76cf7bf43d523bd7f45848f0468ecb27d863a70988c926f3fdbc48eb73d4181d021c7b74d5aba2c8d83b3206ebe59e14ae935274f51

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                              Filesize

                              24KB

                              MD5

                              5e62a6848f50c5ca5f19380c1ea38156

                              SHA1

                              1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

                              SHA256

                              23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

                              SHA512

                              ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              5375caecbec7fb22b4da54f1f6a01691

                              SHA1

                              7c556595112ed1124d49ca38231924a03317580d

                              SHA256

                              aa30b7a52fa8d13ea93b4e5a067c3edbe917ae81e9e700090da6835b0e25bbc7

                              SHA512

                              8c8c12411effc9637115eff50009a795ccb2f6c893a4b4cc0ec082e8a3bcfddd9058e865012e36ab302ad9d73ed96ffa66f403d159d327006e19eae5b39a9c6e

                            • memory/4780-239-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-245-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-236-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-237-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-238-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-219-0x0000015D35040000-0x0000015D35050000-memory.dmp

                              Filesize

                              64KB

                            • memory/4780-240-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-241-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-242-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-243-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-244-0x0000015D3D640000-0x0000015D3D641000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-235-0x0000015D3D610000-0x0000015D3D611000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-246-0x0000015D3D260000-0x0000015D3D261000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-247-0x0000015D3D250000-0x0000015D3D251000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-249-0x0000015D3D260000-0x0000015D3D261000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-252-0x0000015D3D250000-0x0000015D3D251000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-255-0x0000015D3D190000-0x0000015D3D191000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-203-0x0000015D34F40000-0x0000015D34F50000-memory.dmp

                              Filesize

                              64KB

                            • memory/4780-267-0x0000015D3D390000-0x0000015D3D391000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-269-0x0000015D3D3A0000-0x0000015D3D3A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-270-0x0000015D3D3A0000-0x0000015D3D3A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/4780-271-0x0000015D3D4B0000-0x0000015D3D4B1000-memory.dmp

                              Filesize

                              4KB