Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/09/2024, 17:49

240928-wd2pla1cre 4

28/09/2024, 17:48

240928-wdn4ha1cph 4

28/09/2024, 17:47

240928-wcyasayapr 6

28/09/2024, 17:47

240928-wct85ayapp 1

28/09/2024, 17:46

240928-wcpnms1cma 1

28/09/2024, 17:46

240928-wck1fs1cld 1

28/09/2024, 17:46

240928-wca59ayanj 1

28/09/2024, 17:45

240928-wb28cayalq 1

28/09/2024, 17:45

240928-wbt7qs1cjc 1

Analysis

  • max time kernel
    17s
  • max time network
    18s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/09/2024, 17:49

Errors

Reason
Machine shutdown

General

  • Target

    redirect.html

  • Size

    6KB

  • MD5

    6128e2da322af8a3562db916755b2bfd

  • SHA1

    eec78e14b2cb67c03f760faa021a2910347b37f4

  • SHA256

    3e69556870577730f7ab51f65b03e99cba32a0cd9edda179135a59c11a1ef9eb

  • SHA512

    8b12e9cbaa28bc2260fa6fe6a921b21c2ac597794d68dc137d057eadad2c3c46ebfd8f0ef468a7150bc0d85645cfdf0cfe461464b54be7ef5cdaa4c416b4bd37

  • SSDEEP

    192:dTHLxX7777/77QF7LyrN0Lod4BYCIkaOQX26:dTr5HY40+CIkaOQXL

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\redirect.html"
    1⤵
      PID:988
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3280
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:5084
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1276
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4940
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3172
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1556
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4696
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3a80855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4216
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
        PID:32
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:4028

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\1568373884.pri

          Filesize

          218KB

          MD5

          13e8857c11c103c86af5a010ba171f66

          SHA1

          dd8f6ee3cd8b1ac01c480e0843c323805c3cf2ae

          SHA256

          8b69fd5d6b540b3080b438f3cf0d42f3266654e786ce7dc5e85855d309e962ac

          SHA512

          8454d4a02c15e12428628aaf9df2f5ec48d261e692a8b4f2e7e81d83c3acd6921bfb2d3ebc76f78f124fd0065852af348bec56a91e7ba9c54525615d6b7804b0

        • memory/1556-70-0x000001136F5C0000-0x000001136F5C2000-memory.dmp

          Filesize

          8KB

        • memory/1556-68-0x000001136F5A0000-0x000001136F5A2000-memory.dmp

          Filesize

          8KB

        • memory/1556-78-0x000001136F7F0000-0x000001136F7F2000-memory.dmp

          Filesize

          8KB

        • memory/1556-80-0x000001136F800000-0x000001136F802000-memory.dmp

          Filesize

          8KB

        • memory/1556-72-0x000001136F5E0000-0x000001136F5E2000-memory.dmp

          Filesize

          8KB

        • memory/1556-58-0x000001135E940000-0x000001135EA40000-memory.dmp

          Filesize

          1024KB

        • memory/1556-74-0x000001136F7A0000-0x000001136F7A2000-memory.dmp

          Filesize

          8KB

        • memory/1556-59-0x000001135E940000-0x000001135EA40000-memory.dmp

          Filesize

          1024KB

        • memory/1556-57-0x000001135E940000-0x000001135EA40000-memory.dmp

          Filesize

          1024KB

        • memory/1556-76-0x000001136F7C0000-0x000001136F7C2000-memory.dmp

          Filesize

          8KB

        • memory/1556-66-0x000001136F590000-0x000001136F592000-memory.dmp

          Filesize

          8KB

        • memory/1556-64-0x000001136F500000-0x000001136F502000-memory.dmp

          Filesize

          8KB

        • memory/1556-62-0x000001136F4E0000-0x000001136F4E2000-memory.dmp

          Filesize

          8KB

        • memory/3172-50-0x000002476FF10000-0x0000024770010000-memory.dmp

          Filesize

          1024KB

        • memory/3280-16-0x000001B655C20000-0x000001B655C30000-memory.dmp

          Filesize

          64KB

        • memory/3280-35-0x000001B654C40000-0x000001B654C42000-memory.dmp

          Filesize

          8KB

        • memory/3280-0-0x000001B655B20000-0x000001B655B30000-memory.dmp

          Filesize

          64KB

        • memory/4940-43-0x000001C12E180000-0x000001C12E280000-memory.dmp

          Filesize

          1024KB

        • memory/4940-44-0x000001C12E180000-0x000001C12E280000-memory.dmp

          Filesize

          1024KB

        • memory/4940-42-0x000001C12E180000-0x000001C12E280000-memory.dmp

          Filesize

          1024KB