Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/09/2024, 21:52

240901-1rakgstcng 3

01/09/2024, 21:49

240901-1perestcjh 3

Analysis

  • max time kernel
    50s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 21:52

General

  • Target

    https://www.behance.net/harrismaqsood31

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.behance.net/harrismaqsood31
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
      2⤵
        PID:5044
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:1280
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4796
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
          2⤵
            PID:5104
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:1252
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:2204
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                2⤵
                  PID:996
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3212
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
                  2⤵
                    PID:4412
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                    2⤵
                      PID:4512
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                      2⤵
                        PID:3828
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10972559194357711447,9115209550073833088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                        2⤵
                          PID:2952
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3448
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2008

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            ecf7ca53c80b5245e35839009d12f866

                            SHA1

                            a7af77cf31d410708ebd35a232a80bddfb0615bb

                            SHA256

                            882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                            SHA512

                            706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            4dd2754d1bea40445984d65abee82b21

                            SHA1

                            4b6a5658bae9a784a370a115fbb4a12e92bd3390

                            SHA256

                            183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                            SHA512

                            92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34f8cb15-828f-438e-9c46-f97079ccafb2.tmp

                            Filesize

                            5KB

                            MD5

                            b0898cbb3d720d73703591cef3ab230e

                            SHA1

                            3db73f358888ff55f81e20f1ea84adb435974fa5

                            SHA256

                            2f4a918295dcfaaa59de0df9d95620052cf8a9ead8f27830d949634c7d85da3d

                            SHA512

                            0a2e3394d706e73dca9bc2d075679e0d71cee065352deacfe43df8270c3df9160ed02cbc970a87d83e35d60a0dfe833bfaf36c5d68afe2e65509dda9b26ade42

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            53bf4e1ccf1d6a6239e05de955b75729

                            SHA1

                            0ed6bfad4d19866690078724640fbed94858cbad

                            SHA256

                            5b261891b5445b1ae3060e0aa7c24fcd158c98840f9ad8cb5dc87a1dcc7e32da

                            SHA512

                            3d1698dec9ac1cc4facc9d1e5a6de7e381a1a52b306eb979fc324c51b3d9066de10f1b09a7eb5317e5556250461c21d6b1140d9632456cb68cef3f2bfbfc028d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            6a151df9527b2dade439a0f9d7201a09

                            SHA1

                            93042bb6d7d602c6ba05d5934d0c9b58739dd3bb

                            SHA256

                            a01b31273d248990918ab486400425326a92be8b207df908a3d9275ac97d89f5

                            SHA512

                            b3bd23347ffbf330a6dd12d6906ec5d4adf948936815663a9115130d6a645522a2547a17e5a8e80e0275987a4bc759d1cdbcc72c447b20db553ad83556d5aa49

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                            Filesize

                            96B

                            MD5

                            1280e87268e7a9315378abb0422d9afb

                            SHA1

                            32d54b56cc1772ddbb63bae2947d35a74907a90f

                            SHA256

                            63184302719712739adef83a598ddb2b177bef3f42149c8692414a8c6a26b278

                            SHA512

                            b17a54ffb1c1a4cb52ffaa037b2a15cb41b10f924eb72c14e13b1bed64a160c4cf155be0269d7a5478ac82ff208ba94b2bb6cff82790fb9d319de9965d50ffdb

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fc80.TMP

                            Filesize

                            48B

                            MD5

                            6ddbfd987c34e90c0d6165a6a52cc960

                            SHA1

                            73ec28320081625f10d021500a12e3c20d160ebf

                            SHA256

                            ba827a14bb82c121568e6e6f38046e61c7ed7171a1b7490861d8f505387a2c31

                            SHA512

                            ad38996b6c3cefe91064bc2de781367a642299bd10a901b1386a41e8c53478418fb5d53f2f40e6f62f8363284ea7f7ceeaf2bd85abc74e93640c70a96ed92e8b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            a811b110a3aa60a1fc9bbac634c0ff9c

                            SHA1

                            6ef4eb9f31204587f37a8b020fea4f2f70daa0de

                            SHA256

                            f4026a664e5c57f9c7a665f612bff03c217e8c5e9215b1c30ae89e1fde267cd9

                            SHA512

                            fe6ad4ba9580011f24ebbcf09cd6f13ebc20a1eb2888c6da5b4559d9747b117dc4dee718968a47c13eeb8ca93c4d589466fb2e648865da86cb28fe36a6fc730b