Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/07/2024, 05:57

240715-gn455sthle 8

14/07/2024, 19:00

240714-xnnq6avfrb 8

Analysis

  • max time kernel
    135s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/07/2024, 19:00

General

  • Target

    https://ify.ac/1Ic5

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://ify.ac/1Ic5"
    1⤵
      PID:5084
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5104
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:216
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4788
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4536
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3384
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3892
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3744
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4188
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

      Filesize

      4KB

      MD5

      1bfe591a4fe3d91b03cdf26eaacd8f89

      SHA1

      719c37c320f518ac168c86723724891950911cea

      SHA256

      9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

      SHA512

      02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQ9VIUB\edgecompatviewlist[1].xml

      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8W0QNT51\hcaptcha[1].js

      Filesize

      380KB

      MD5

      e5f6f819663927b1cb8f28843f35aa64

      SHA1

      e171ae6690d1752ab28414444d623181ff808593

      SHA256

      c2aee5e4e7e4c0b6e15d4645e62ac949441031c1c966451f988885a43c13b099

      SHA512

      8e48046e21a08ae5ff5728906e7dba45f04cb9ffdccbadbc010bca68f89779dc9800f835793048d328639ca66fca620e76c41d03371e9419f910cce4c1975466

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4BCNLTQR\ify[1].xml

      Filesize

      356B

      MD5

      eb1f23fbcc0e9e67d6a0772691658064

      SHA1

      b2eebb095b31f0f74b22d41f0f39656cf2510d39

      SHA256

      0054a039ac7d36e7b13d6def0dba631c8150b0fb00d8dbcb481e91c9742a3b72

      SHA512

      eba9329b7ec55506aae094baa8a384a04c6542624f07f4644487e0bd078186054a9c756bd4b7c50ef5002e656ccf962a81848e3d9556f480a0c5d2e8a393835d

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4BCNLTQR\ify[1].xml

      Filesize

      352B

      MD5

      eb60d4f70f44aa1b1d9f0201f67dabc5

      SHA1

      6be21bbc2383fe4e299416988b7de6ee2e01e893

      SHA256

      e2c7f37f6180ea44097ea7730c68f7770c0f17dcd97ea1c1896bb706e941e4ff

      SHA512

      bba5be78b82b42760362eb2d845ba85658b9fa2ebcbcdd2fa545a44e972d98dc202168c633be13c0db06f395eac491d8fe2f4e6858a4ba99de79cf3fac293033

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4BCNLTQR\ify[1].xml

      Filesize

      1KB

      MD5

      08ec73fb44de56c9a5c3d7511418107e

      SHA1

      47b2df92c3e795ceb8a13111290a135223cc930b

      SHA256

      d48654ffa5556be4bdf507c58bd38e6532e07567b42c6dc5f58fce70918c29e1

      SHA512

      6841d309fa939502e8496dffcdc1099a317440779f4caa00db41302fb93458ca147ec70d2063b03286ab9f8c3f64d153d3280c7a150b022616e027d7b49ea3d8

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4BCNLTQR\ify[1].xml

      Filesize

      1KB

      MD5

      cc78f8f9a0cf9dc0572e1be8aa0e8018

      SHA1

      1a19c02b525a4611114e861eefcc53df0b67638b

      SHA256

      0ed619e0c796ca3a4c30337ed0b021caa11743cc94c57d50183cc8204c79f70b

      SHA512

      62c36a134bf33225c633bd6a9af77c6b54fc2c5609044272ffd0f2f3e08c53c6a2c75a3f122cd91478899aa749e9dfe112bf79cad276be6ebb40f7487446e368

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4PBEA12A\favicon[1].ico

      Filesize

      14KB

      MD5

      de5a68ecf1315791471000eea42de65d

      SHA1

      3f3e7239d7ec1702868f51e9d28e528c6c60e984

      SHA256

      fb94090003c3fd820119448548cb3f11a37304608d1f7401824111f53cfbe61f

      SHA512

      0b5b8b073714ec8e0cd1992d722c669515ce589d14f4dc224e9c1830c4aa8d3473c441758f8128f381607c85acfd015b1fa0f271c4595c33f4d162eab69f2501

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\LXK62INV\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      1KB

      MD5

      7fb5fa1534dcf77f2125b2403b30a0ee

      SHA1

      365d96812a69ac0a4611ea4b70a3f306576cc3ea

      SHA256

      33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

      SHA512

      a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      436B

      MD5

      1bfe0a81db078ea084ff82fe545176fe

      SHA1

      50b116f578bd272922fa8eae94f7b02fd3b88384

      SHA256

      5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

      SHA512

      37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      174B

      MD5

      69c0eecd0331ce6a7885a6cde9f5368a

      SHA1

      0b2c059aedf5c08b0e55899cdea329b415c51fed

      SHA256

      76f48d2214e789f291799645a155561ecc1862f1db7def360bfd3d22f30065b7

      SHA512

      16c2babe72785efb7073fd5cacd57247d40f22fe927d8fc5a35e54702ecb74c5e1e6b5ebd4dacee77d871c9e8f0dfb1c17397366d3dd1d98d1f7e2466636e523

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      170B

      MD5

      d7c8003831581a191668930aaf8e63c6

      SHA1

      5abbe34456599d6cd30c327d93b1a269070fa149

      SHA256

      0998f333c61aa25afa48deaa08b8a0e815c8ee1e39fc36dc568cb07627028a04

      SHA512

      f91e40f30a3c3183bb06fdabc455c845d8b65fd55cfde5d68a75149cc234c22dae2fe8961a88e3ecf4a569035343f31e4876e39ceb3a4a2b5409dc3d016a6ea6

    • memory/3384-355-0x0000028AB5D70000-0x0000028AB5D72000-memory.dmp

      Filesize

      8KB

    • memory/3384-189-0x0000028AC7330000-0x0000028AC7332000-memory.dmp

      Filesize

      8KB

    • memory/3384-201-0x0000028AC75B0000-0x0000028AC75B2000-memory.dmp

      Filesize

      8KB

    • memory/3384-198-0x0000028AC7590000-0x0000028AC7592000-memory.dmp

      Filesize

      8KB

    • memory/3384-73-0x0000028AB61F0000-0x0000028AB61F2000-memory.dmp

      Filesize

      8KB

    • memory/3384-353-0x0000028AB5D60000-0x0000028AB5D62000-memory.dmp

      Filesize

      8KB

    • memory/3384-192-0x0000028AC7550000-0x0000028AC7552000-memory.dmp

      Filesize

      8KB

    • memory/3384-378-0x0000028AC7600000-0x0000028AC7602000-memory.dmp

      Filesize

      8KB

    • memory/3384-70-0x0000028AB61D0000-0x0000028AB61D2000-memory.dmp

      Filesize

      8KB

    • memory/3384-63-0x0000028AB6600000-0x0000028AB6700000-memory.dmp

      Filesize

      1024KB

    • memory/3384-380-0x0000028AC7690000-0x0000028AC7692000-memory.dmp

      Filesize

      8KB

    • memory/3384-195-0x0000028AC7570000-0x0000028AC7572000-memory.dmp

      Filesize

      8KB

    • memory/3384-76-0x0000028AB64C0000-0x0000028AB64C2000-memory.dmp

      Filesize

      8KB

    • memory/4536-45-0x000001DA98500000-0x000001DA98600000-memory.dmp

      Filesize

      1024KB

    • memory/4536-43-0x000001DA98500000-0x000001DA98600000-memory.dmp

      Filesize

      1024KB

    • memory/4560-429-0x000002297C2E0000-0x000002297C3E0000-memory.dmp

      Filesize

      1024KB

    • memory/4560-459-0x000002297CEF0000-0x000002297CFF0000-memory.dmp

      Filesize

      1024KB

    • memory/4560-472-0x000002297D340000-0x000002297D440000-memory.dmp

      Filesize

      1024KB

    • memory/4560-461-0x000002297CEF0000-0x000002297CFF0000-memory.dmp

      Filesize

      1024KB

    • memory/4560-417-0x000002297B580000-0x000002297B680000-memory.dmp

      Filesize

      1024KB

    • memory/4560-420-0x000002297C060000-0x000002297C160000-memory.dmp

      Filesize

      1024KB

    • memory/4560-431-0x000002297C2E0000-0x000002297C3E0000-memory.dmp

      Filesize

      1024KB

    • memory/4560-464-0x000002297CEF0000-0x000002297CFF0000-memory.dmp

      Filesize

      1024KB

    • memory/4560-447-0x000002297CD70000-0x000002297CE70000-memory.dmp

      Filesize

      1024KB

    • memory/5104-16-0x00000185B4320000-0x00000185B4330000-memory.dmp

      Filesize

      64KB

    • memory/5104-0-0x00000185B4220000-0x00000185B4230000-memory.dmp

      Filesize

      64KB

    • memory/5104-238-0x00000185BAA10000-0x00000185BAA11000-memory.dmp

      Filesize

      4KB

    • memory/5104-239-0x00000185BAA20000-0x00000185BAA21000-memory.dmp

      Filesize

      4KB

    • memory/5104-35-0x00000185B1580000-0x00000185B1582000-memory.dmp

      Filesize

      8KB