Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    528s
  • max time network
    536s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 13:10

General

  • Target

    https://drive.google.com/file/d/1_RVEpnP7H-42DnsVPNVej8iVxQerIpm0/view?usp=sharing

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1_RVEpnP7H-42DnsVPNVej8iVxQerIpm0/view?usp=sharing
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcbe46f8,0x7ff8bcbe4708,0x7ff8bcbe4718
      2⤵
        PID:4436
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:4104
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2300
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
          2⤵
            PID:3208
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:4464
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:4220
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                2⤵
                  PID:4292
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
                  2⤵
                    PID:3752
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1924
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
                    2⤵
                      PID:1724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                      2⤵
                        PID:3036
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                        2⤵
                          PID:4264
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
                          2⤵
                            PID:2828
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11322928941907332733,11216714911270229190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2932
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1724
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4024

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              1f9d180c0bcf71b48e7bc8302f85c28f

                              SHA1

                              ade94a8e51c446383dc0a45edf5aad5fa20edf3c

                              SHA256

                              a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

                              SHA512

                              282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              60ead4145eb78b972baf6c6270ae6d72

                              SHA1

                              e71f4507bea5b518d9ee9fb2d523c5a11adea842

                              SHA256

                              b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

                              SHA512

                              8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              408B

                              MD5

                              314a548081a59632d715b52adf731fa3

                              SHA1

                              170f7f6e05998cf89d337ff5d7a3f099fde1cc80

                              SHA256

                              d6b5ce4d654242ac8b8d6474e1685d7782117b66a173aa893e22af5c28673e63

                              SHA512

                              1a573262369e2f900b126fcf3415128ee7c0db765c77412a8e5d23272454da8129eeb6000f85cb2068c38f3f93d11a8c311e89c0cb8b44d1b96b2f5dc6a6926d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              832200818ebb4a24ac1168737329063d

                              SHA1

                              e8a0f19c5ddb35486a54167bfae068fa64d0dd3c

                              SHA256

                              703df020613de974b00c3c503124898c070f95c121514cfdb3826cbc1e431ab4

                              SHA512

                              a138c18e0d81ac6d9e6b26a954b3c41a3c8069f14f8349c95f9601f85812fb12dd294f3da1995b6c33c20055ec89ed799056dad08dbcfcccd826dd19b63815cf

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              a2907c547fc2bad5307696800c27be86

                              SHA1

                              18efbd047078c39f81f70507e3139653c6667ccb

                              SHA256

                              f5813e9a6a22ff35d49523262e5b41bd5d8a412dc92aa2accf8091aaa144ab69

                              SHA512

                              8e556989dc4b532a52bb52c048a9607cca09ca65a3062b8e1ab687c795c4c5d8b3cea988f56b7223b8f1d2bff42e487fb371603ebcbf72186b5b0c3cb38ca1d5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              ef1c1473a51f9cb4031f06986a2cf9ae

                              SHA1

                              0d46f99d0801f99ae688dedf3bb3c7cfcec18ec3

                              SHA256

                              38d973a93936400097121bb3e10b10030abee04710df74d307b880fe4490571e

                              SHA512

                              2175c384945a94d454a46ecf9f5d27ea2c0d1dad9a7e452f6079752115e520afa9fdfb88cbd1e06b0ac63055d6b8681a30102a2df6d999c7e7d05cb0ebb5d246

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              a6066774d24a28a5c85ea71b59455d2c

                              SHA1

                              ea812decadcf55a31554f7a909dc1f7581e8307c

                              SHA256

                              692c1944ea74c29ccdb089998cacd6fb82c4bf83e9e2429f659723e5ab9890f7

                              SHA512

                              836b8ae637e4080f0530358e662f12793793c8588f5f2bcb170051c9daefa5c47ab5caf8310070665aad03ab6fe02258f64a541987fe614f34486b9fb15785c0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              2d4b800a49f42b26228edfaf79a9b2cf

                              SHA1

                              be164745c8d220bbfa79440a6e853df103c87752

                              SHA256

                              9909bf108550984480a0b8d05c3c69726b7a6769c8f54be210ac11bed2108bfb

                              SHA512

                              af1891d0cffe7035688aedc7b30ccf3abd6e45b5563001d383365c145e2eb3156823c036e96ec6536918698b7f2ca787c62a3e567a0a86d6b71f301fb0b06fa6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              4842dfcc3fcbe6030445f48661e65cd4

                              SHA1

                              5739fce6fb3c9b380eb2f97f1abb1f39f6d1375c

                              SHA256

                              7883e365bd4abdc4d054657ab41e2cb22ec02679016dab29d522c7e1f7c65083

                              SHA512

                              796c6275d77b326ffef7d65063150e0401ff8ddffb83ffa08cd77ab2cd13b3c4e802d0899f509a9bc6b43acd60e672eee56a0aab451ebaef6c525c728c32f1f7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              61deb67b656fb26b2f78c9531b4f51c3

                              SHA1

                              94009bb3962793c66ec75b4e4de9e4cb56c41c07

                              SHA256

                              de13ff7dae1706688d5bbf31f9ce1c58377efd9a61ec18a099c492580edbc682

                              SHA512

                              f6cc96dda1caeb408be46a9e808d38a909fea1ebcdd8e7e9eb2e0b8200a73527ea9065c1ec14964cf5ca63deb0a6af13cb46af4ceb4f7d627cd4e389bdf40456

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              74d0b4427f46d3777e8a07fc6d1adde6

                              SHA1

                              16c582da52d6ad5a72012a1e42bca119cb8c0391

                              SHA256

                              f1f63dfaf155520f6722c29598537c9949f94752cc653c559e9c488f5cdab50b

                              SHA512

                              95600fa7632149a5c0d301ac19e649a1cd9024ce8b94732fa0af72d1d2fefe7ee0987adaaad3b026e897dbcf0a42ec0434ec6d11e11490445df101c509d8bee7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              90bee677f74d654e9c8505d6e14160d2

                              SHA1

                              1ce1dc9cb8ca316993b7b20049ad15b9981eba72

                              SHA256

                              a696a6281408051e0d9107b7d6483823958a2a68e0a3172b01c8396c4c4429a5

                              SHA512

                              5f61e45439c87fae21b90d4a7fad5ce1fc5aab551d35694c36373d5a0c2858ba916cc1de9a4da092f4fa576bff006064cc0008dec692e16198383d7f6af9faec

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              dea6cf3252f9f9ad9b60b34cdb10d949

                              SHA1

                              d329727ad685d6e1d6920b854f34427c7267fe21

                              SHA256

                              44a7d800a993f1a7afa21d56f928f6c0a2ff06f13be25475de4dc4fe335e6adb

                              SHA512

                              c3dcbfc73dec77b51084c1b754953c8faa19f231d3f3683c9aa0084218a7845e30493411153b4b97d716e2a51a23eeffaec956caaa95aaac8484a11c1b222136