Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    240s
  • max time network
    267s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 15:32

General

  • Target

    http://discord.com

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a8746f8,0x7fff5a874708,0x7fff5a874718
      2⤵
        PID:1700
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        2⤵
          PID:1356
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2636
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
          2⤵
            PID:1540
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
            2⤵
              PID:2968
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
              2⤵
                PID:5044
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                2⤵
                  PID:4688
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
                  2⤵
                    PID:4632
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                    2⤵
                      PID:2940
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3412 /prefetch:8
                      2⤵
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      PID:448
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
                      2⤵
                        PID:5064
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4008
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                        2⤵
                          PID:1764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                          2⤵
                            PID:2696
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                            2⤵
                              PID:2660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                              2⤵
                                PID:464
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3660038870824401813,8400436372989255505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1284
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3476
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4476
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x49c 0x328
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1400

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  9e3fc58a8fb86c93d19e1500b873ef6f

                                  SHA1

                                  c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                  SHA256

                                  828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                  SHA512

                                  e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  27304926d60324abe74d7a4b571c35ea

                                  SHA1

                                  78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                  SHA256

                                  7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                  SHA512

                                  f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  2KB

                                  MD5

                                  6c8a0a463e4d2402a87df14ce5e9c8a1

                                  SHA1

                                  fc969ddbb61591ef214dd118a0ea8ba0f8293ce1

                                  SHA256

                                  53a7aec9f6899f524875ffc0da47a9bd48dfff8263a965ca3d058837a77bec5a

                                  SHA512

                                  82f83efc7baa7a6728bf8496727ff332c4d0038e5c77555293155a4e1a06611c97bcaf7962660f0fd21cb580418db45c2fe36530e5789094e9b83a6588cc6e32

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

                                  Filesize

                                  96B

                                  MD5

                                  0a74a97f7a6ac54417dd440b30c0c9c2

                                  SHA1

                                  bb93f53191e3bf28287c9227a9671b0ea68eba41

                                  SHA256

                                  35fd0d51b2bedfe8175b55333271edc3aa634b8a0e72e70d0fd50e927ecba190

                                  SHA512

                                  3e4405cbd554a7f527aa21573b5e64e4be6d04af93fc6be431c1855abd816a4eed4ca001f2b4deef2b4475608ccbb60f487b09f512ffb2163299124ffccd4538

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  64f5836fc9f86eecc163f7307a2daaac

                                  SHA1

                                  5c87d2dfc68223e22a3ecf10be1188da1c87a4a9

                                  SHA256

                                  aad8a0f5e0aa761eb028b7758fb02d5aec4c94d7c8a70e1375fae6bfc8abcce0

                                  SHA512

                                  d0fac85d9783511aa01cb270af9d8c9e85072e02254c9342bdbea1ce6d5e6d17faa329c7978fa61fdf6cbaa655bfd9d08d622ca252a4ef9623c0b0a2b261eb28

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  a54da8d4d984b550b774eb33dd1854dc

                                  SHA1

                                  2a2524464cec75221ee0ca32c35c73a8f562ae0f

                                  SHA256

                                  c5ce0385c2164c7eff41ce1344fbc0fc6f37e52f35aada9f91b159c394575b4a

                                  SHA512

                                  3613f76b8703acfd4221ac671113de48e8af812738912b2de72ea5d61e0baf3fbc9ae054346b426cb10b2a5c6671ed2df41f3d0507a8913990c68852ae618295

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  720c2a8a3e61ae19ca1cc0f9a73b71cc

                                  SHA1

                                  a54d44e098c759911c4a8449a23836912749f488

                                  SHA256

                                  c904ef61f0ecce10cce22f8cd33b8c152418ee436c281f2697857209638ee4ff

                                  SHA512

                                  0d83c3e4646b88109220dee283f11fba308cfb27b156a32801af0faf1f88a67bfd7dfd53dd9f1da33c70c4be8427637107caee88ba208beb7c7319d85a326f7a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  d4bfcf3ef246d274bd141c96ef49061b

                                  SHA1

                                  3afa35422eb08ec4f88a676380d094befda7cd38

                                  SHA256

                                  547e2d41c84569068ffb22eaf8d4d54dd4c3f9ee628eab55cd0fe11561c1dc4e

                                  SHA512

                                  bcccda499ef9882a54c2bcf6d668ac089d72b2950cc4583061a34088f208ce89a044e847dd32785cae167277a16ae5aeb4e96736de33bd1be2d82f23711d6004

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  60182999f96de8b08789227cb45eab63

                                  SHA1

                                  dc402d4cc5ad16311868422c8f297a248f915015

                                  SHA256

                                  56b9b92cbf69b700e51683a400bc41817d51cb077cd7df941d215e17bab0b9a5

                                  SHA512

                                  3c6c58727612d005888247828212316c2bf498c1243ed72f8e686a850bcc0fcada9c8368d41892dbe4717a8348122857f2b85a6369439340070aa1e68b7f7c68

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  7f68ff2eefb5298f286f9aa207af2523

                                  SHA1

                                  dc977021784437def816594312979ce4cea51b57

                                  SHA256

                                  63befcc3f327700e989c70706beba25ef73fe1b9bd24b008208838241f5ff3ce

                                  SHA512

                                  1489993a083d0c4e113993e43d80b433bcbc7faaf7895c708f308bbfe61fb0dc91bf2e73b8e7f07a6da2bc061ad6ed46495cb22e8c61eb1be239e7101bfab1f2

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  8b8e61b02187c3b46fa9730b82a3fb8c

                                  SHA1

                                  c70f886358730403c8f3c2c92c1804494d4a598a

                                  SHA256

                                  528b60df214ea35a4e1dda3ea71d77a973c7bdff7b4ca3dee43ee88beeb8f419

                                  SHA512

                                  5b55bbaa92df2fbe57866f28840e8c2fdb56cd62f5af1fb8d3f107dc704a72f54c6b52de607d784a29a3558fe9dad5e709cdae851e0a3018550e2d7cd5b3f262

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585649.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  5fc951e257fb8ddb8faa81664db5facf

                                  SHA1

                                  f6baab6fb2b10031346643c592964c8f60df4d36

                                  SHA256

                                  d77c7419f970e2d8bc9b60a6aae5cffcf211d70a67dbfbd4748ff0aa207cfec7

                                  SHA512

                                  f401353365e0561e378a3877fe7656806ab812f40105947e3d7a923248e4a53e56dbf8958a5cbfdd5564c841574557ab55545a58080526ece7f91ceb316e12ea

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  4b1610ee02b0bd44604e078996ccb6c1

                                  SHA1

                                  7154d9b97d2cebb1b70d5a6db9bd06ecfc1491e8

                                  SHA256

                                  35ad70889578a93f8c537c6e822912dee81fbccac82c590db57269abf5a43444

                                  SHA512

                                  a55b120f25f7458ab3f2032c88b2a3b14c4a5fac3473d3cded3b950d2619efacd3f75cc9a57950c18425ac4eef44e80d41ee7d76acf67de951787e6542f02c0e