Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2024, 01:09

General

  • Target

    d93bac85fd70b1a3e28331a56faae6b984a84494ab29cc704279b2cf5c33dc15.exe

  • Size

    38.7MB

  • MD5

    27511b815d4702eb95df4b544ce9e510

  • SHA1

    9d1c67fe84671d3b8dc53e22611485683ffecb80

  • SHA256

    d93bac85fd70b1a3e28331a56faae6b984a84494ab29cc704279b2cf5c33dc15

  • SHA512

    e2c94dbb1b5095a506c43ea5d86110fafd05ef162fc4c9c9ce8f18c6f3144b91fed386ea14cba2b9318d2e66c9f1a06c51063ecfa0155997600387b995d15b8b

  • SSDEEP

    786432:z9iTfRwFQujb2l7R1oIy9icDxvVUyaPZn:Qf2Djb2l7Rs9icD1wn

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d93bac85fd70b1a3e28331a56faae6b984a84494ab29cc704279b2cf5c33dc15.exe
    "C:\Users\Admin\AppData\Local\Temp\d93bac85fd70b1a3e28331a56faae6b984a84494ab29cc704279b2cf5c33dc15.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
      2⤵
      • Enumerates system info in registry
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3240
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x44,0x108,0x7ffa35f946f8,0x7ffa35f94708,0x7ffa35f94718
        3⤵
          PID:4896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
          3⤵
            PID:748
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1172
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
            3⤵
              PID:1756
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
              3⤵
                PID:2948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                3⤵
                  PID:1276
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                  3⤵
                    PID:4364
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                    3⤵
                      PID:2348
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
                      3⤵
                        PID:4492
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                        3⤵
                          PID:2700
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6288 /prefetch:8
                          3⤵
                            PID:3584
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
                            3⤵
                              PID:3256
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                              3⤵
                                PID:3212
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
                                3⤵
                                  PID:3192
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2888
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
                                  3⤵
                                    PID:2032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
                                    3⤵
                                      PID:2064
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,325012415228480989,15626057500116035195,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2960
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1136
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3780

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      e494d16e4b331d7fc483b3ae3b2e0973

                                      SHA1

                                      d13ca61b6404902b716f7b02f0070dec7f36edbf

                                      SHA256

                                      a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

                                      SHA512

                                      016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      0764f5481d3c05f5d391a36463484b49

                                      SHA1

                                      2c96194f04e768ac9d7134bc242808e4d8aeb149

                                      SHA256

                                      cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

                                      SHA512

                                      a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      408B

                                      MD5

                                      dc8287d937cd726aaa5a66d0cecb489e

                                      SHA1

                                      ac8797cc4d7307b6050e22d2446d1e3dc03a074b

                                      SHA256

                                      4f489b1bf804a7baea6c7ed5500d84ea57ae29a68beebf6ba61f89695fd56198

                                      SHA512

                                      7751ef6a435703ed08602fe47845bfdad2b60dc03faa1ed347bf8b5257b6a59e10abbe88b373ebc2cb1222ce6fe1edfffb8ae34f267265f64bc0a919296ae2d3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1002B

                                      MD5

                                      3467ae4e80ef5e5a9757138cf0f437f9

                                      SHA1

                                      8c7ac6c1917f61b27b5fef13f64a74fe3dea62f4

                                      SHA256

                                      247338985a9b1563c543ef6c7e38f968f85421607d76b0626cae35868df5943c

                                      SHA512

                                      1b626fd42413a5bfdead24df287a04b4fd0c68a11ca17858ba2b5f11f80157a45357ca0d0801796acb75681d8555f01c25bd1cf696915078ee1c69f31fcb48de

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      da4f3c1cb42c0b35fbbfa06e154d33a3

                                      SHA1

                                      5fcf8a526bc730a6fb8975532d9c00842f2abade

                                      SHA256

                                      ad0b42d2de5b309ed29536db9d88909486558eec9adc4ab15d0bacdba62cdfd9

                                      SHA512

                                      21afc7233b65699f39ccd0dd523c73f49dc825193612f36c8f0c853b8aedb4d71147c9a5c460e7dccb1fd3123f46f97b7dad7ed3d203977eda6bfd5c24b79cdf

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      95b93213e353ae58456ecff6a6347a85

                                      SHA1

                                      fcbd93589b599874839eafb83567df9aa90c55ea

                                      SHA256

                                      d1cb5fcb0f222ab87051f91259a07b738f79e3b4e913b2a1e59af3892fd53972

                                      SHA512

                                      866b2620cd0662f7f3742701f363263636872f2ed8fa50fa69d21aa23fd5de6aa52a069531f8ece5fb5299253da927776df35bbc35752e3e134fca5259c88e2c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      707B

                                      MD5

                                      caa34bcf17ffb0299df59d41bedfab2e

                                      SHA1

                                      ca8210b72204d530ab96590236baa1b8c45c0e19

                                      SHA256

                                      93f971e328067f7e62d66fdb6e5fed1cc5aeb1961fd6ffb1231ed9f8e36c2de7

                                      SHA512

                                      47dd8af5c2e8e76f95baf8ee6dded7649b7440ef8caeee790b02c8fb8b98f2048ec24fb1e19b94d6a43452706f360895d4d4fd66a286bdb6313db99d48cbdbc1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      707B

                                      MD5

                                      1c4b927acb26fc9e70ad7fc8f5beeb5c

                                      SHA1

                                      0511eb0522b3d70d4db4f41c4ab034ad569d6ab9

                                      SHA256

                                      e9b43cf4a275e30994dfeeb9063c7ef5ddcc505f49173b115aafbaa303619252

                                      SHA512

                                      31e66fc4b66b55ccbb6b5b48cbc9ceaeaa5b76c6cda06dd69a76e75eeed74530d56687d84d93cd254d6c1b32803e45e038b698c29771295dffe40f6a79f91c94

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58aac2.TMP

                                      Filesize

                                      539B

                                      MD5

                                      5c9f7e07a334a5960a67e15379827b21

                                      SHA1

                                      770ec8ea783534e5df7a02e6f7127f8c30c6bd89

                                      SHA256

                                      22ac4a66191b529848af5a89235207accc7c29543ee49b89fdcff15bf05dbd62

                                      SHA512

                                      43d8fb8ecd334c090ec032a47f3fb716768059a59fdd70b20ba8cce8e24737d8fd34f05b8d9d5b41430e95bdf613d87b374113dbb0eb47789cc2cbd199370663

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      1a322c37d849e02da698ab7ffa90816c

                                      SHA1

                                      da7dd2bf0a8970f920de857cb973ec0a716bd653

                                      SHA256

                                      bb5e0ee6db79a5fc6c50e8f39012e0f8d27e203c64c4855a38558f14b2d8cb2a

                                      SHA512

                                      597c2d459c60202ad5b6165c02a03ab5e30af7073ca48a7d3465ce89833bdffda527e109ade9fd9e59416554188aa785fc45cb3e60a7fc2f0269629f4f795808