Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 14:53

General

  • Target

    Synthesia.exe

  • Size

    19.2MB

  • MD5

    5dc12d9dee11f6490a909937e56991cc

  • SHA1

    21f6376cb3c755e742ee1c7450deb5fdf4068931

  • SHA256

    1993138131ec80dff681ae5e31935f99f80afa7508472edc7d502bfe2c53a2c6

  • SHA512

    c11118fc24b89dcb48f008de46cc908570bd3477a8f294d57172736c3c8f11256142de1846863363409604f501c3b3b33a2418f2e5fd25653b03309f149fed42

  • SSDEEP

    393216:3Bt7gzmb1SFXN4Re7Aa/PAfMwT77No6R/af5wNVMWigOnrard:RtWmZSFXN77Aa/PwMwH7m0Urard

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Synthesia.exe
    "C:\Users\Admin\AppData\Local\Temp\Synthesia.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://synthesia.app/support/opengl
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3dff46f8,0x7ffd3dff4708,0x7ffd3dff4718
        3⤵
          PID:1444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
          3⤵
            PID:600
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:8
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
            3⤵
              PID:1308
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
              3⤵
                PID:2540
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                3⤵
                  PID:2584
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
                  3⤵
                    PID:344
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1976
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                    3⤵
                      PID:2240
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                      3⤵
                        PID:1080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                        3⤵
                          PID:4048
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                          3⤵
                            PID:2784
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8914090866271246634,9939107779295416136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3764
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x3f8 0x310
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4472
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3264
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3016

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            eaa3db555ab5bc0cb364826204aad3f0

                            SHA1

                            a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

                            SHA256

                            ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

                            SHA512

                            e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            4b4f91fa1b362ba5341ecb2836438dea

                            SHA1

                            9561f5aabed742404d455da735259a2c6781fa07

                            SHA256

                            d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

                            SHA512

                            fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            144B

                            MD5

                            eb3141d25c3e40a571d944539d234b87

                            SHA1

                            4f74955b595aa70e732612eb1f59627b9e242693

                            SHA256

                            6089466b1efecd761511ef8a344a81efe37d73e5845722ad8fb821a16c4c16ae

                            SHA512

                            67a174f7ba083f4b4443a25d8469149d733c1ff7cc632a459bb63c52970a5eb066e46818cdc781e4404929dcd51740c800aab43224604cec509d08daf29f06b6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            486B

                            MD5

                            ecac48e240f8e465b650d5e2d5a7b233

                            SHA1

                            0cc3930d94b29a8c78106a3a959935e3f3c2cfc5

                            SHA256

                            fd9f2202fb7863712d342375e0a911672c2493eeb453d7dc53f2a92bf27cb844

                            SHA512

                            ea8d55e5bcb644cb3d9252339e88a3c1a6327df123b219faa6c871e3509d0b2969c51904ea31fdff95e7fa128aeb5fb05d90ef428d98e6b78e9581b35ef7d13f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            ceff1cc4748bbbf86517429231b8d517

                            SHA1

                            3a4450bdcdeb3a1e495111a62025eb0cb4fe00da

                            SHA256

                            3da1a4041c527f3125bb0480cc06772ccc5dec8deb384a4e540e7956047e2e71

                            SHA512

                            35b2220d0e9a76619f5c9d056bd7e948338f5473c5f69043d82e6a9de78905d7297832d13f0e2d741ca8c51a4bd480a6d2a55dd759dca41ea6c3bf1f1cd2e468

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            9a3c91b4708f6d66eb50158275cda47b

                            SHA1

                            c5c7cc5a2198123c0fa470386285e30e70988766

                            SHA256

                            39fbc3678eec62bffb7a95202810af59d2f574e999c89ac7a7d01fd14b7eb817

                            SHA512

                            ccace42e800f97f9dfa712a0a895c42b44ae89fcbc194297735feec648bae789e298f97c4fe54b7226f086b57959cef0fa11220f51f0af730c21923ca70a479d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            1be9e51f58e9c02e25c098d52dde906b

                            SHA1

                            ac778aac78ac30075d38c153c605cf3d4c71bfa7

                            SHA256

                            d9c535631902199f1a07aade30dca6fd02a5dd6a4962dc9e0b3412c90a73dd95

                            SHA512

                            37507cd973dcc3fc45ae4c93aa8bd8e40ea27243ceb29a4acbca2f14e816b2a8c562d7d850b728918df476a03e28a6adf05cc1977231605d77be3146598a207f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            1d10621d8eb5fee3b392163bc26b7e18

                            SHA1

                            59fbc7336bc14511bb0d18955b36a4bb7b48bc6f

                            SHA256

                            619c357fb4411e76344135823c379341c7d1cc55695702058710dd5511a847c7

                            SHA512

                            b3fb674edbdeb6325a281b731040be84eaba9e1e692029068e802f2c509c68f0a65ef685531ef3dd5784d5737946a7f369eb104c01bfd558d07784fbf6027d0f

                          • memory/4080-2-0x00007FFD4D880000-0x00007FFD4D906000-memory.dmp

                            Filesize

                            536KB

                          • memory/4080-10-0x00007FFD5C3F0000-0x00007FFD5C51A000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/4080-4-0x00007FFD5C3F0000-0x00007FFD5C51A000-memory.dmp

                            Filesize

                            1.2MB