Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    28s
  • max time network
    29s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/08/2024, 15:11

General

  • Target

    https://drive.google.com/drive/search?q=pine

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://drive.google.com/drive/search?q=pine"
    1⤵
      PID:4140
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1420
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3664
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4488
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4960
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:872
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:1608
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2848
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3692
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\H2C4PLQF\favicon[1].ico

      Filesize

      758B

      MD5

      84cc977d0eb148166481b01d8418e375

      SHA1

      00e2461bcd67d7ba511db230415000aefbd30d2d

      SHA256

      bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

      SHA512

      f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\EWD65J0R.cookie

      Filesize

      131B

      MD5

      1b0feee732348abc44ac8c1ad64cb992

      SHA1

      d6cccfb3415905cf146f75d068da14e17353df40

      SHA256

      a9bf51cb3843eda2b2c185c0e1145ec0212e382c7cb3bdbe7d007123e4d84ec1

      SHA512

      6adb1601ade1ea49c60997abb5a7c386063e6ad6bef9cc0caa288a8e006df9d2671eefc84c56da379f94da35dd50d667c7145caaf64069f0e6bab121297fd934

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UCZ7MT1A.cookie

      Filesize

      241B

      MD5

      5b64cb0337b472b3b71dba74efa03050

      SHA1

      e41359942de07ea6565c3ba571529329c0eada0b

      SHA256

      7cc0eb5a8e6babbdae41808774b95ee7116cb8a5e0901dd94ba39ea962aeedd7

      SHA512

      db29f93d9f619a700de0a85d9ac6b615ef881ecae5624af8f9d1de1dfd79df99d2767aefa7965ccb3c235f79eb2defc9c0bec97b0a725178f9cd20097907b376

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

      Filesize

      854B

      MD5

      e935bc5762068caf3e24a2683b1b8a88

      SHA1

      82b70eb774c0756837fe8d7acbfeec05ecbf5463

      SHA256

      a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

      SHA512

      bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      1KB

      MD5

      894ba2af7b1332da962c9b79d7f87b7c

      SHA1

      eea1d6aff7e8edde1564d9ffec41cc5d9748e963

      SHA256

      b8b5f6de950851888cb7375d930a7a4d27c1393974f0741d30980d320b8b1af3

      SHA512

      06a782ba83e457f2fc9147187afd53bcbff9060ddbb3b11ec965bd096d540d3d16d662c11e07748612c980423579ac372977499da63d44a130c5b945468ade7a

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_77091706961B5755E24B23AC417CA949

      Filesize

      472B

      MD5

      a1de7f987e17e16c3b0324da87d791c5

      SHA1

      d81cd9ad2d865d82d779a0b588e3f126ab3c8482

      SHA256

      dde5731f0107ac3bfc6b345819f145d2c556b0ef60b24d18671f8a73c51d959f

      SHA512

      42bd534c0a48c4b68f97af3d46776d3b88b516489f9cec78bccad921c43e9cdfe00b55d02039018aa87d587b28db43c9f966bf7ec2712f39fcc40f0db7b248b9

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

      Filesize

      170B

      MD5

      a9043c0581637d31b4870b82ef1b4f43

      SHA1

      6b0ede05dae0ca95e05829c841792e1c40133b5a

      SHA256

      79bb1f5faf967702cefa130a2c76020ec522177d5296a692105106fd94cba7b3

      SHA512

      cfbd833bb4ba7c585c0e951a5471e05f19b7fbd6756b11263f7188dac1bd9dccba542eea3d8611ea3fc0431064486bc5bbb040eb5838947443bc89b55a606120

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      410B

      MD5

      b97e69fd0a272e23d2eb72ee2943b904

      SHA1

      2ef45653cc46833fc321c29849f5fc500f80ef66

      SHA256

      dd56f64441b172bb8c8485bf54419d1d1699a602fa3b035dd8d276fd808c4be2

      SHA512

      3f069a8d55048389d4042a51251501829abd2883072bf7584450ab2379f129ec059274692c8a9ab044ec908d3f7cfe3961d1c3ef5c9fc3911a6815228c3e9a70

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_77091706961B5755E24B23AC417CA949

      Filesize

      406B

      MD5

      07d7db5492ea7d3133b8b2559a39c261

      SHA1

      4fe8dc65e022408c3d8e26c8b0ac927992333c5b

      SHA256

      8c936b9adefcd7a7fe7d8abfb2a212be57fd10ec87e783f47ba8bf5e1a2c3852

      SHA512

      b012c89ae47198452647c3950f4c459aa7202b8414dabaa9bd7da84cef086694bf1d4c9b5eeb0e7e5d2898857495a91fd99b903dd3a69fe7a1e9d6a50f00cb3a

    • memory/872-74-0x0000027322350000-0x0000027322352000-memory.dmp

      Filesize

      8KB

    • memory/872-76-0x0000027322510000-0x0000027322512000-memory.dmp

      Filesize

      8KB

    • memory/872-72-0x0000027322330000-0x0000027322332000-memory.dmp

      Filesize

      8KB

    • memory/1420-0-0x00000235C7220000-0x00000235C7230000-memory.dmp

      Filesize

      64KB

    • memory/1420-206-0x00000235CDB80000-0x00000235CDB81000-memory.dmp

      Filesize

      4KB

    • memory/1420-207-0x00000235CDB90000-0x00000235CDB91000-memory.dmp

      Filesize

      4KB

    • memory/1420-35-0x00000235C63A0000-0x00000235C63A2000-memory.dmp

      Filesize

      8KB

    • memory/1420-16-0x00000235C7320000-0x00000235C7330000-memory.dmp

      Filesize

      64KB

    • memory/2848-95-0x0000023E5E600000-0x0000023E5E700000-memory.dmp

      Filesize

      1024KB

    • memory/3008-172-0x000002B92B260000-0x000002B92B280000-memory.dmp

      Filesize

      128KB

    • memory/3008-141-0x000002B919E20000-0x000002B919F20000-memory.dmp

      Filesize

      1024KB

    • memory/3008-156-0x000002B919FB0000-0x000002B919FD0000-memory.dmp

      Filesize

      128KB

    • memory/3008-159-0x000002B92A740000-0x000002B92A840000-memory.dmp

      Filesize

      1024KB

    • memory/3008-188-0x000002B93C000000-0x000002B93C100000-memory.dmp

      Filesize

      1024KB

    • memory/3692-120-0x000001B010EE0000-0x000001B010EE2000-memory.dmp

      Filesize

      8KB

    • memory/3692-124-0x000001B0218E0000-0x000001B0218E2000-memory.dmp

      Filesize

      8KB

    • memory/3692-122-0x000001B0218C0000-0x000001B0218C2000-memory.dmp

      Filesize

      8KB

    • memory/3692-110-0x000001B011100000-0x000001B011200000-memory.dmp

      Filesize

      1024KB

    • memory/3692-111-0x000001B011100000-0x000001B011200000-memory.dmp

      Filesize

      1024KB

    • memory/4960-42-0x000001E342BC0000-0x000001E342CC0000-memory.dmp

      Filesize

      1024KB

    • memory/4960-44-0x000001E342BC0000-0x000001E342CC0000-memory.dmp

      Filesize

      1024KB