Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    35s
  • max time network
    33s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/05/2024, 19:04

General

  • Target

    https://www.youtube.com/watch?v=1skjubXSaz4

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://www.youtube.com/watch?v=1skjubXSaz4"
    1⤵
      PID:3104
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4900
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4888
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5012
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:772
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4088
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2712
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5016

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml

      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\64YXVWRC\scheduler[1].js

      Filesize

      9KB

      MD5

      0c425dce0edd3711197d189f01e62c8b

      SHA1

      55fc028dd9a64da1a048420f28d3f5fe5c639d90

      SHA256

      29c52c8434cb01cbe38b0520c3bd2a7ae59d345370a302ff60c7cbc0a3be2388

      SHA512

      b2c8c5be49a9e0939d7605294ab2288aba84b2596a9e75348f973d1f6285d5057bf5b89188ecb106079ccb475238c22064e649bbc2112cb2c2fa1ef15355093c

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\64YXVWRC\www-i18n-constants[1].js

      Filesize

      5KB

      MD5

      f3356b556175318cf67ab48f11f2421b

      SHA1

      ace644324f1ce43e3968401ecf7f6c02ce78f8b7

      SHA256

      263c24ac72cb26ab60b4b2911da2b45fef9b1fe69bbb7df59191bb4c1e9969cd

      SHA512

      a2e5b90b1944a9d8096ae767d73db0ec5f12691cf1aebd870ad8e55902ceb81b27a3c099d924c17d3d51f7dbc4c3dd71d1b63eb9d3048e37f71b2f323681b0ad

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\919SXSMT\rs=AGKMywHoxuXKRK9kymBRw23Rr3kRRvWglg[1].css

      Filesize

      2.7MB

      MD5

      9abe624a6b9c1ab565424de4e8342131

      SHA1

      dd3d34047798883cfeefd248af5855818bc6ca1f

      SHA256

      1ac256e6379c2a316d050e9ddc5b6bf6980cb2dfc76f658436c25bca9c98e2d1

      SHA512

      11b6e6d80888748b5b166afb257ea4784ff64b81d7cd160458d7f564ceb04c14321c205b5aa39ea8c89ac0ec1313106f5db2e430bbcde2e166ddd906e8b82b23

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\919SXSMT\www-main-desktop-player-skeleton[1].css

      Filesize

      2KB

      MD5

      2a5f27d8d291d864d13eaa1f5cd9cd51

      SHA1

      b39f9b99b924e5251ac48fad818d78999cfd78d4

      SHA256

      056232b6127143e2f8bf4218db355d978e1e96f5dedcce59a9f5d6ab92b437f1

      SHA512

      1b54f1e13cb38e41f2a65db3cdc2bc702a9e963751b1ef0338d67b95816441b0143e1d4dabc99f276a04f9c00570bb8933f1bd87394998b3878c268b08ecf24a

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\919SXSMT\www-main-desktop-watch-page-skeleton[1].css

      Filesize

      8KB

      MD5

      64c8e3b11cfffc8ebf2240e4f46ab492

      SHA1

      71276680811731f983502e477a87e87cfe72d75f

      SHA256

      3acc199c41eb3c884ee9884c15e6b78975499be2255aa203dba38ef24440181c

      SHA512

      497a48233bb198e05517e2cba003c2c5ba25183e1654b5b8252b9823f0859497ccab66a77e243238b27ea6eb826ae4fc72efb2f32b2b378edee7f9dfb87f4756

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\919SXSMT\www-onepick[1].css

      Filesize

      739B

      MD5

      9ace9ca4e10a48822a48955cbd3f94d0

      SHA1

      1f0efa2ee544e5b7a98de5201fb8254b6f3eb613

      SHA256

      f8fdbb9c5cdceb1363bb04c5e89b3288ea30d79ef1a332e7a06c7195dd2e0ec4

      SHA512

      25354aeecb224fd6d863c0253cd7ad382dce7067f4147790ee0ce343f8c3e0efb84e54dd174116e7ad52d4a7e05735039fa1085b739abbe80f9e318e432eed73

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\919SXSMT\www-player[1].css

      Filesize

      367KB

      MD5

      734b31725e29c82861a2c08184fc7055

      SHA1

      5ae2d674dd076c2025ead424f423b53bc5f46e6c

      SHA256

      2958e30eda7143b853db1d5e3a9e606f83d3bf40a162148fbca5a1b61d184223

      SHA512

      952fc63062d9e622bf71a8d2d83a63550cef69750e4d25a2659740883486c788aabbc4cb5a73a599f4f8031a8c514ff5f1109701803b35d777414f92d9210f95

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KCFQ0QY1\intersection-observer.min[1].js

      Filesize

      5KB

      MD5

      936a7c8159737df8dce532f9ea4d38b4

      SHA1

      8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5

      SHA256

      3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9

      SHA512

      54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KCFQ0QY1\webcomponents-ce-sd[1].js

      Filesize

      95KB

      MD5

      3b596f0548b72bacd4717dd61c5de8b2

      SHA1

      fff335b6f805acd1d91f81d64cdd9abbc0ff499b

      SHA256

      45eb6593f0f2747a22b5ed6f378012b29825f7e2d2836cb753b8f3d1b4e3dc5c

      SHA512

      27c372d49f1ba3afa33c41f876d319d1034c93b52eb6181ce9747bdd22227fcac1c4249cf679fbcf527d046683d304e4aa66d4fb177df5a4ab266c89e320e1d7

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X2NN8ELQ\base[1].js

      Filesize

      2.5MB

      MD5

      1a07b3637d035852c1bf496244e02e5d

      SHA1

      5499d5010793c37998d7109f7ada060bb53f9516

      SHA256

      489c5db1fe048e9e5d4deb643c382c2baee253283ec1c55f5e62b12c746e0e64

      SHA512

      954c45573703c72322a3821d7d910bad40b20a18f5530bdc5d7389a7c5d5ff33f7a0a6815d9c59300b5441ed6b127fc238897e3a586b73c4d583257e2ac265e4

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X2NN8ELQ\css2[1].css

      Filesize

      2KB

      MD5

      5912f3bba71c222672dfa244a60acef0

      SHA1

      317a49729bb8654c3986e6b32278258a1d692d81

      SHA256

      48708ab3b01bc53a736f7f85e0badd9174872faa981e78b32c16c4efcaa59d99

      SHA512

      770f13af0d6ebe7ff9d925efccd05b0b2e5afd5fbe19770562d88936d541a298a49aea028f5122a255fb5026b4a5f37c0cf52831212ecaaf378a5769ff0379f7

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X2NN8ELQ\web-animations-next-lite.min[1].js

      Filesize

      49KB

      MD5

      44ca3d8fd5ff91ed90d1a2ab099ef91e

      SHA1

      79b76340ca0781fd98aa5b8fdca9496665810195

      SHA256

      c12e3ac9660ae5de2d775a8c52e22610fff7a651fa069cfa8f64675a7b0a6415

      SHA512

      a5ce9d846fb4c43a078d364974b22c18a504cdbf2da3d36c689d450a5dc7d0be156a29e11df301ff7e187b831e14a6e5b037aad22f00c03280ee1ad1e829dac8

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      1KB

      MD5

      3bfb237d95f9c34465d50360f39b3ceb

      SHA1

      2cdee845ea6ebbd3cd0466b0eae4752842de86cc

      SHA256

      2ceaddb29268e6112e7aa95722894fb061238ad4e2b247ce23595609daa5eb8d

      SHA512

      da55bf0fd898acda5dfd2366a96d439807e502c763dca35c3a119c3ab45f6e3d821a1e3fd29858e333606ef0e822f3373b9cb8c41d95736131bb001ad5b6a16f

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326

      Filesize

      472B

      MD5

      e9b4f0a4494f9167c4e1d4e3510c7379

      SHA1

      f1647e3f9818aca7401ba340c1b418a6e31fe22c

      SHA256

      d84d3b7b5b595ff221879b045276c0faec7adf90a7fd963be0fe16d9e1385b2d

      SHA512

      57f3ee82e686c5e816b23517c2eb6697c7ea3ace996b0146c975f07bcdaaaf70a32fedbb2c5dc03628a265d4c7946d471b6e1dabead9e039c25dc5e14d019ddf

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_70D9325C2B892EC1D2469F50EEF1D995

      Filesize

      471B

      MD5

      b8933aaea659e2dae561476258dde44f

      SHA1

      cd7adff14c6090b3bf1fd95b531e9a8b1b35b746

      SHA256

      89c3674ca25665854dd1bdfb6fc978b78ec186abbe524010d69034f88d663561

      SHA512

      2fa599f236f779d3e24dcfab3a92a893d0c959a4120520e4947e8f51c9495f7ea92616a966d311af04dbbd625e12ae9addeea859c9765d17b88e7bf2a3ea5303

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

      Filesize

      724B

      MD5

      ac89a852c2aaa3d389b2d2dd312ad367

      SHA1

      8f421dd6493c61dbda6b839e2debb7b50a20c930

      SHA256

      0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

      SHA512

      c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      410B

      MD5

      3bdc7498ad346291631dbb573f4e1616

      SHA1

      282c6feb9bfa90387c8b2d8c158b782720a4bfd7

      SHA256

      568023a43b5bf37a418a7b1c3902580679afe0af7dc62199ec2570633a81da80

      SHA512

      482a9def2bfcf0529a6e5693150c1f0f1268c2c171a95d208be92e877a2463c1b0ba78accef8b93101f43a38eece715489305f3ad3776d376056827cb3c89b8c

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326

      Filesize

      402B

      MD5

      b939563553ed7686b6a854995eb26de6

      SHA1

      1a093397b4a5f115c4d96042b9338a379a83035b

      SHA256

      87743125843c2fcc9b8fe7901a33057d70a992a392ea620e7e15436d4bb4eaaf

      SHA512

      48d766834eb30d9142a534cb158b0d2993a7cbaebb09d54ef710d5c4f3178a346035c69b036f23b34b77a778ed6a566a809f509935cd83895c8f1cb3411e8503

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_70D9325C2B892EC1D2469F50EEF1D995

      Filesize

      406B

      MD5

      1be3139f127c482f9d13690f8887b6e0

      SHA1

      8920a650a86e48907cf744b21215be6e63591c0a

      SHA256

      c015aa71bd94d5464e9d3555f3e9e2184c54293436e4bbefc63407c2cefbc09d

      SHA512

      f8ea3fe30b81257ce2d65385da6c95d47a849c43deb492f2bb40b30e6542d7431e926e22db229eddeae9c486124f487e754ab02894ad506eb90f5430dc901142

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

      Filesize

      392B

      MD5

      71ef4846c636f2940b42fb12b8924726

      SHA1

      fa378154b4673e5234e210e41fe00bef12bee60b

      SHA256

      dffc1a69b0476a26f2d33ef24438dbe3d066d1a92b3d262fc169c8ec754efe96

      SHA512

      48240b3d1a275eef4b0e6bfb8b823e739cc4cc10dd3b19945e04389bb8487fe7ba6c529900456badc7f6a3a30922506277e78a6b26ee3f853f1abbfdf3b86ce4

    • memory/772-42-0x00000200B4900000-0x00000200B4A00000-memory.dmp

      Filesize

      1024KB

    • memory/772-43-0x00000200B4900000-0x00000200B4A00000-memory.dmp

      Filesize

      1024KB

    • memory/2712-135-0x000002DCCE9C0000-0x000002DCCEAC0000-memory.dmp

      Filesize

      1024KB

    • memory/2712-165-0x000002DCDED20000-0x000002DCDED40000-memory.dmp

      Filesize

      128KB

    • memory/4088-96-0x0000023BE2A20000-0x0000023BE2A40000-memory.dmp

      Filesize

      128KB

    • memory/4088-66-0x0000023BE2390000-0x0000023BE2392000-memory.dmp

      Filesize

      8KB

    • memory/4088-70-0x0000023BE23D0000-0x0000023BE23D2000-memory.dmp

      Filesize

      8KB

    • memory/4088-68-0x0000023BE23B0000-0x0000023BE23B2000-memory.dmp

      Filesize

      8KB

    • memory/4900-16-0x0000027A8BE20000-0x0000027A8BE30000-memory.dmp

      Filesize

      64KB

    • memory/4900-35-0x0000027A8FFE0000-0x0000027A8FFE2000-memory.dmp

      Filesize

      8KB

    • memory/4900-0-0x0000027A8BD20000-0x0000027A8BD30000-memory.dmp

      Filesize

      64KB

    • memory/5016-170-0x000001A6DC800000-0x000001A6DC900000-memory.dmp

      Filesize

      1024KB

    • memory/5016-172-0x000001A6DC800000-0x000001A6DC900000-memory.dmp

      Filesize

      1024KB

    • memory/5016-181-0x000001A6DC3E0000-0x000001A6DC3E2000-memory.dmp

      Filesize

      8KB

    • memory/5016-177-0x000001A6DC360000-0x000001A6DC362000-memory.dmp

      Filesize

      8KB

    • memory/5016-175-0x000001A6DC340000-0x000001A6DC342000-memory.dmp

      Filesize

      8KB