Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/08/2024, 16:56

240808-vfpmdawelj 3

08/08/2024, 16:02

240808-tgr88awanm 3

Analysis

  • max time kernel
    64s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 16:56

General

  • Target

    https://utah.us3.list-manage.com/track/click?u=d1348808c2201ade52e69992d&id=6b500c2923&e=ade1132688

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://utah.us3.list-manage.com/track/click?u=d1348808c2201ade52e69992d&id=6b500c2923&e=ade1132688
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffdfa9946f8,0x7ffdfa994708,0x7ffdfa994718
      2⤵
        PID:3116
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        2⤵
          PID:4264
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1204
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
          2⤵
            PID:4760
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
            2⤵
              PID:1244
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
              2⤵
                PID:3224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                2⤵
                  PID:380
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                  2⤵
                    PID:916
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4980
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
                    2⤵
                      PID:2492
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
                      2⤵
                        PID:2516
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                        2⤵
                          PID:3756
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7006483172815443469,1901872960396877764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
                          2⤵
                            PID:1752
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:544
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2724

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              53bc70ecb115bdbabe67620c416fe9b3

                              SHA1

                              af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                              SHA256

                              b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                              SHA512

                              cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              e765f3d75e6b0e4a7119c8b14d47d8da

                              SHA1

                              cc9f7c7826c2e1a129e7d98884926076c3714fc0

                              SHA256

                              986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                              SHA512

                              a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11256eb5-41b4-4ad4-8c3b-209343e1fc68.tmp

                              Filesize

                              7KB

                              MD5

                              fd735940262a01a8ff72956317a588cc

                              SHA1

                              650803945b88039c9914bb50eedd0c5d268ef1e9

                              SHA256

                              de9f285911b3fd30e47f805fb1a945de79b4176272a420234d079709cdc344fa

                              SHA512

                              ef5495abfbf4520669b4153dd841782ae12e2a01311b0d56368160a5ac671bd90cbdee07d6a7d59cdf3250b8c60825f876841dc38c9ea8643eec301158e6534b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                              Filesize

                              91KB

                              MD5

                              6e342eb1d75767dcc171c9698522ed50

                              SHA1

                              a9f50447055d64b5c2c334fb2283e563c041bc8b

                              SHA256

                              b8709d2f1ddd7066bdaefba00d77524628daf0b91651c1f7dd4f77f407150362

                              SHA512

                              6f9f5dd75f9f1f033f35c855e78c2dd0519c174af42d61400c6e7bdd13e262c7c012397e6f027b2d5080b763f522c67b57985f05131a81f71ed9be898be7b67d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                              Filesize

                              107KB

                              MD5

                              ec050ca11559b56ea7d191b634b72761

                              SHA1

                              4b5c9cc01b4f5a00113b43a597dbc4a656619ca9

                              SHA256

                              859d1f3504c9ec80b863f7caea7511b36d728a9763b061826df5a2d4f3bd7a18

                              SHA512

                              6af7537820b6749abc54787585643cdb1dc5ac1b4a5758311a8fb746671f613a262aa1907dbc023c5144fe4d0e93dc9b0255b3abc6bd63c4b1229de07b114996

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                              Filesize

                              34KB

                              MD5

                              509318d208440311cd19a0ad8dfa09e3

                              SHA1

                              121f6e8b877b796ed0ddd10a2f3d4ca24b8166c9

                              SHA256

                              05077feb1d01020db907beb1d0aa356efe9493313fad393efff036ee9b2df704

                              SHA512

                              b4fd1e80698453995b49bed6d3c4cf08e35989a3cb1881c2822bd001b5470d49e8cf50a2fa413c02e8a9bd229c96a3e67dad5e82a30bb2a92b954f2b1a7bdf4a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                              Filesize

                              35KB

                              MD5

                              d9cd9fc0b5854ee96ed1f029cb565d04

                              SHA1

                              23e0f19aa2bd15612c99a8da711fe52ea9ec25e3

                              SHA256

                              d46ad3c3ba31a10a8ecfe01f101171831bd483c76e779eb887fec7648d8ed23b

                              SHA512

                              6c4bea1d6b99ba475ff633e0d9b07632789a72fdc6c098034aef93ea1c74736e96a74919a420f389760e541b9fd49f61827cb00716797f6b44aa74074e1388d8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                              Filesize

                              52KB

                              MD5

                              c5f9957602446db1fcee8645025a8c7f

                              SHA1

                              e0ce3b627f317298060bd6e124769e3bfe928c59

                              SHA256

                              3ea6682e65a573997bf48c9f8fe65ce10d8d4d10b90847508ec9a25d37991d21

                              SHA512

                              860ed128109d27a09c6d1e4e3e5c7da2fb9a9607737253e156a2ef5d00f9d0d03ace7950bc70eb272462793193005bb7da3ec509becf0b9033a6be84bb77f28e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                              Filesize

                              102KB

                              MD5

                              b535502404a561c68a56bd976a142adb

                              SHA1

                              9bb073598c07e150fd09d38783cc035406bd3a1b

                              SHA256

                              ed0531acdd8f51090b13776e3adc4d67468812b598125365364957fbe57e87bb

                              SHA512

                              a17ba39a9732523cb3538ffc8ff8967e448e50df63da0331a508f93bb6342cb37344027169723d153a33557b9c407a99403fa5227565bfb0ee0c185252bac389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              63758d486940f0c99568093700468ca5

                              SHA1

                              f95cfcf0d9206484a7fde72b289aab965211e87f

                              SHA256

                              ec7ed66b3eb90881b79908b7082698a28f577c005f0b0ffd9c81c456b9eeb9e0

                              SHA512

                              5802b8ce35066515f3cc91c1be069860817531fd56e1cefb9d7e2f1e2f55c95ded912790d80c7cd3ba533b6fe03aeb3b24e878f1090512ef3cc83305939a5773

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              ad4dfa074674a30a55ddb62c6315bc45

                              SHA1

                              3ef924e06e9d26d43b02baa01bc9f108eb48f605

                              SHA256

                              83819e28920746724c3af353f68772401f66a50c8b447c122971de81175503c0

                              SHA512

                              89a5387e842fdd97db3792da7ad87203c2fc36215516b31eae5fe97ce1d5bb5b0d55299a60d6c4015754dd027a7ebeb8f197d2ff1defd14dae4b11853c648382

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              36048450c0e939f544ff234232254db8

                              SHA1

                              e051ec749385c238c3e89d985e63e74632faab01

                              SHA256

                              f8ca27074bfa3638917fab0d25a1719f55dca475ca83e4dd08e075488bcf0484

                              SHA512

                              7e43d552cd0ffe30047a3b63c9b96f7e1570ebe4f5acbcd6234465b1ca5c7f2c92a079746b4a4e8fde83e1f61da9d1db8b0c7fbf61f78bd5d7ab563434b1da81

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              87df4ec3d185e394d39de9a7e440d74f

                              SHA1

                              17b863fae45f97620c89a2cf311f6f8fa3159aaf

                              SHA256

                              488360af3e76cd96494dddc73db973ac68f30b32abfd846587affaf47e0dd226

                              SHA512

                              df009bb2e5b05e08c775a8d684a948b875e6e1f8db96b70ffde5dfce70545ab0ecff5094e657df77eee42350a815f8824e4923cf50774e85602eb52c87804fba

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              6aa78f16c516a4d514a4215a3ba114f1

                              SHA1

                              1b0a6b02f5bbac8cf76e22ea76463a951a0589cc

                              SHA256

                              37ec57d52f5e0d5840b82d010607cc3498b6bf685256062711bef7b075f433ff

                              SHA512

                              844e89e9b47946dd84189afc02ef87545988ad19fe1a9def85fddcb201ab26cab715f309aed9ad2d64b95a17d0700359d0b1e72ba51e455786830292dbd0ae21

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e37a.TMP

                              Filesize

                              1KB

                              MD5

                              d8094aabe570661a62972c9d09925292

                              SHA1

                              1d1535a6827ff4a26ae4e9d00f8b53fb990c1286

                              SHA256

                              587d3a9903803bde418d02d5ba2528da4f6304bc62b0a217033973dadf23c3a7

                              SHA512

                              00d7e0d61b517ccfb4929dceb3065354c4e9791994f4706523d146c2f35c897f3fed7fc49fbf912d1f9e19017a50efbfd33433b0075079b64ccc26b60bc17ddf

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0bd9b6c-217d-4972-a8a3-aeb71f892662.tmp

                              Filesize

                              6KB

                              MD5

                              7e1334df81f85d5798ef86cba3f973c1

                              SHA1

                              aafc1c16e78b9bdd2205125a03924fcaf389554a

                              SHA256

                              e0b11d8bec4797b385346d8486b82180370b869b1af05cdacdd4a390bfe56595

                              SHA512

                              2e261ec1bd276d6759d541f9381d99cdb42d75e97f4233d1d7097c734c3d0dfa4a02900fd552d34f76a7fe8a5eb396f5a29b797e8896111409d8836ac928509a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              d85fbc1932093688c54a0cdb5f9bcab6

                              SHA1

                              75de53bb17b2dab0b1dff63e8583f916c7144ee6

                              SHA256

                              40ac39966fca1e7f194705e9a77999c0860de59141e9701e416df99773b37d0a

                              SHA512

                              73758d258e5c077e9f569bbe8c6cea52ce490177fecad96b749e8ecac7ab6fb4f11082d496ce8e628e3346c0a6a673e2822f51ee6a2dee7e637acc8e6fd7c3bc

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                              Filesize

                              2B

                              MD5

                              f3b25701fe362ec84616a93a45ce9998

                              SHA1

                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                              SHA256

                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                              SHA512

                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84