Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2025, 20:29

General

  • Target

    https://www.paypal.com/donate/?hosted_button_id=6LTGT8QJ9Y59U

Malware Config

Signatures

  • Detected potential entity reuse from brand PAYPAL.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/donate/?hosted_button_id=6LTGT8QJ9Y59U
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8983846f8,0x7ff898384708,0x7ff898384718
      2⤵
        PID:4676
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:1792
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2964
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:448
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
            2⤵
              PID:3028
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
              2⤵
                PID:4948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                2⤵
                  PID:4232
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
                  2⤵
                    PID:4392
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1404
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                    2⤵
                      PID:1488
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                      2⤵
                        PID:4392
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                        2⤵
                          PID:3636
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                          2⤵
                            PID:1396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2243074586851886748,13945508019686639935,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:688
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1932
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4208

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              0a9dc42e4013fc47438e96d24beb8eff

                              SHA1

                              806ab26d7eae031a58484188a7eb1adab06457fc

                              SHA256

                              58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                              SHA512

                              868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              61cef8e38cd95bf003f5fdd1dc37dae1

                              SHA1

                              11f2f79ecb349344c143eea9a0fed41891a3467f

                              SHA256

                              ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                              SHA512

                              6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                              Filesize

                              215KB

                              MD5

                              a199e9aaef96c5e19a9b209b08919b6b

                              SHA1

                              1348d66066a90e23f29f0181ed39c272a5391369

                              SHA256

                              5f93040edfd9d8d1dfaf9b4799f86c0eb5eee768ca9ae69e2c5e524fac63e15c

                              SHA512

                              3e00e8d65a0b77b2e9baaf9a7607ecedf42cb4cf743607448c23dd994f86687af279ab05e85dfd968d42669b74d55ab3b6df90a53a599116eb1d55da64df962f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              840B

                              MD5

                              abbedff14b92acc1fedc5f314fcc3e95

                              SHA1

                              5b29d7a9a869dea59431f6500f8f9738adb016eb

                              SHA256

                              97eacfc25f7740e18ca5b41344044e1e4032339776421d701899169f84f9d121

                              SHA512

                              c3f144abae99bb243d6a628d2b7ad64a506eb71390eb7a6e57e8bed5aa077c49218c19043d47f1480b08501dd57f8f8f7df0b9b6e15dbcf77eadc185148bbb43

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              a0eb025fd5bbc9095a0fd7e2eaa0d398

                              SHA1

                              82b7406498cf1cc771c79537d039b3441971b1cd

                              SHA256

                              0bd8a568ad794f131784dba82f0185fce96b29324f86e29bc7bafc6d0023692d

                              SHA512

                              843378d4a953b499424afee7cb6c347aca93eea2b9fe2d1879b0011c14db4c62aa9379f02c9294a8e1fc66e1f5d5eba66513cbc513198e88cfa79260b1c52114

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              dc234bbd613d04af32084cd55938905a

                              SHA1

                              3285dfa2f316342900258826efc58b3931847227

                              SHA256

                              6a491362890b4d91c0940931b117796e671865425aea2a71e874b52a2eec9754

                              SHA512

                              005f7e1fa61944028917ac68f951ca48216e88430cd665dba5f1fecdcd3a9290cd4cec2a206b922c080808f247af2a6905a4ec9d99179bf1310578751eb207fa

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              330f794686b6e26f05b4e3c564fc27c0

                              SHA1

                              f668b7f482d963433707da876b8152d0dbf89c41

                              SHA256

                              88f7c101ece9da711b113c3fb4132fa6e40295c06d04e7b479a7a9f61a416a8f

                              SHA512

                              aaeb5a0001b9ca4486e2900d3e5c63f3885c16edca0671627660f9020ba7f2819abcf92497dcd44d790681b8ae13aa9fb55f8e242a81f3fe0bca9f54442a1e36

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              712dfe5b767105996abb9c250bb85830

                              SHA1

                              cfdeb60eb85e426310e15db33d157ce69e35fe94

                              SHA256

                              76d1608bd05b03d596aa77f8306e7e6afe16b37c8970ce6163e09db17169164b

                              SHA512

                              c9a9210083236c996942a58133dca8adb9347a2658077ab0d85710e3c02f77474e003fef31c1638b40f8cfa0a9b6d85451d016ec85ad2704dcd200ecaea8b650

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              f969e53768a099c20963d0852ecc96fd

                              SHA1

                              e89f670a80f117ceaa5e954c284422ebfac7aecf

                              SHA256

                              d68eb0f100e15cbe4788dbf7baaedd38f273322c2eb2ef719d88f4b235f10ca7

                              SHA512

                              bbe9e69fd76b722505fb1532461d075af06f887a6c1dddd5d27466df222ed90a245f4e6152d08bdcd85f4a7f9b7658b35e93800afe48cca3b734fc6a4b2a12f7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              d8c012322f2c9bb2ac4f9a29fcc8819c

                              SHA1

                              56eecbf74f71688ceab46d7f6e0313379a8634af

                              SHA256

                              be1f79befad44c41ebd318c7a8ea026fbc27ff5a15badf1fed99764d7e93f96b

                              SHA512

                              40217188c0754907ad74c6f4204e11175a352f5eebc84b64cd5cf8e88db8f347a9f6f48bec0ea966d31135579dfe4d9b7aaa7ab1d238fe6829c9391f8c937217

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809bf.TMP

                              Filesize

                              1KB

                              MD5

                              e3cced134129c717ba8fdc0d59da7fd4

                              SHA1

                              117ab7adf53d010963c6174da554943bc1e40a6e

                              SHA256

                              98418084230d2cecac3620344eca335b7da8bfc8bbc1eeea73a327e21727bf0f

                              SHA512

                              fd035c1aedeb895f90f76668d181dd15e7d9874f840c0ee80ff8433c09a519a490b8f6179fc0833bcbc6327dfe6a927341adec7f4577828ee7b01240fdf20070

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              614e375fcc5fbcb2a00e5f27fe66ab1c

                              SHA1

                              c4582ecf4ff73862e16af54c2fe51709b09aa2f3

                              SHA256

                              96bffc48c2458decc3477e2a86559f56faff9d5067bdaf0239126763c5a9a515

                              SHA512

                              bba5a9dab9bd86283a0548829963623df931f99424d513deec5d2d5adeb8b3b8c026969748c0e0adb4767cc02d8ee9206e460a2b19dfee819f1c71150bcad280