Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 18:19

General

  • Target

    https://www.jotform.com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • Detected potential entity reuse from brand MICROSOFT.
  • Detected phishing page
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.jotform.com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42b946f8,0x7ffb42b94708,0x7ffb42b94718
      2⤵
        PID:4032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        2⤵
          PID:3600
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3580
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
          2⤵
            PID:4188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
            2⤵
              PID:4564
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
              2⤵
                PID:4548
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                2⤵
                  PID:1688
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1648
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                  2⤵
                    PID:1008
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                    2⤵
                      PID:2820
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
                      2⤵
                        PID:1560
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                        2⤵
                          PID:4292
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                          2⤵
                            PID:4496
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:264
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3148
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4996

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              dc058ebc0f8181946a312f0be99ed79c

                              SHA1

                              0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                              SHA256

                              378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                              SHA512

                              36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              a0486d6f8406d852dd805b66ff467692

                              SHA1

                              77ba1f63142e86b21c951b808f4bc5d8ed89b571

                              SHA256

                              c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                              SHA512

                              065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              648B

                              MD5

                              eaeea1ed7b26da21d5f1a4792f0171f5

                              SHA1

                              2d46ff145285e5438f194edbf9fef3238744205e

                              SHA256

                              6e96d7a0e49d0605b085d35e2a80f094c74f2caff5d8a84ea10be9a3db10a3f9

                              SHA512

                              c4d6b6ced1fd18146573d6d456d385394fdb627896147896d1ce8e4aa534f3d0b1fbe28fdffd6e7251e429083c65790ab43a966cc724da735cb2aff62949ddba

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              360B

                              MD5

                              a50df0b7c11b140ec426dd4436835b0c

                              SHA1

                              14b6fd196596d1aa7a0989a3970b2d279222c59a

                              SHA256

                              ff5e926fd5300cbb446d89a9a7dd0bd66b1b24c80266f6363cef52cdd01bb8d1

                              SHA512

                              9220d1c3203a682210506468cbadb7870a9ae4a9a5a7edbb9ff7920f0719cc549d49ddb92d9211c7e5917179df1c4bf0278880e7a32c9c14990e42d34cea7380

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              833a4050b1530a63f5c2383af2b37b78

                              SHA1

                              9c8d4e7afb6271caaa446a1d3ed8ba4550464e12

                              SHA256

                              06b3517c17387bc5553c21550571bcd87929d8066d7c30a9921c8db02644e668

                              SHA512

                              9e475210fd0b9e97942c8cc39513ce3559ff85b94c3eedfcc9d996fad0899afe0ab469b9c539378efae5354cec7cbd555c82d2fedfb918d3c04d9f353f19a9c9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              0d4bf2ac341a6d358bb03b49b14e9a6a

                              SHA1

                              df4a93146b2280f9aefac3b68c71a4543d70484f

                              SHA256

                              f33be6bda1e72d4611f3a7dcdaa7de4cc7811ecd95bbc2e8b6b5ace9cd8eea72

                              SHA512

                              bbaa3108bc5d7874066a382488ee296ba6ac55405ddef5ec7c6e56b3e6cc9d2645f515b3096ee75289c1e6ce358f38816f931589be712e54a0a0d35197f1d3dc

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              db6533e4cc16da56bdb72a4d06103c82

                              SHA1

                              a0522c95885009a871b17b4d0b13a688481564cf

                              SHA256

                              bdad242b38ce5cde05e3ac7577bd87e6c542e8f5af4bc590ca343ea8a8a0fcd4

                              SHA512

                              bbe3911f652dff3bf602288193d04fc12590c6132ad172cb57ee61326de598789507ea7d76e3550fd1d675fc7a4fe52a862f7ad043e282b7e4a853e9064beb69

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              74194a896c1ccd5532230f8913769b93

                              SHA1

                              8b3891309c588b7abdad791eb0b57ab2edf07757

                              SHA256

                              9e767449fe3aa5c29903e402902f1f218f24ff26c4e09e84ae276af2227a7363

                              SHA512

                              7fbd0e196032429a8aeafac6f04bca38345b7309aecd763399b60e8ee81a9ea49ccf308affbaf8bb9623d29b5b2901a9fcd7b7258ccfb4ee7b90ac71fcb0910b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              593fd3ce2314fa8c7a850abd1776b13c

                              SHA1

                              dca501ff8ec40be721ec6c4e7bb18061c5b8cc38

                              SHA256

                              1ecc9d8b50a5d11b8c700d3e5a3cbce190af63f70072398414cf41713ea85b96

                              SHA512

                              3d853e3050210bf1289d5989265a27a16022a8bbc90d5eeb68eddbcba761af147ad2c623bc89358f1ce7e6949cfca36dd1c8785428b1eeb94f007f353be6c15a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              c286cb838a9b4a0fc12150a1babc541f

                              SHA1

                              5e0eaca03e48e1787bd034975d3bdde54cc79364

                              SHA256

                              7b732ce9448dd20bd788f1b09f6fbce8d8ddd9b1791dd081d68dccf2e4cfb1f3

                              SHA512

                              7a7612521ed4d0029eed2baef3768107ddc291e73fb98e65d3b8d4594eb6881cc6842ccc8768db96b5312262a78b3176363a9349f5a7034932e115d297eab28e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              875B

                              MD5

                              19a1d28c29f3d5c274d48682aef74dc2

                              SHA1

                              b3812b622ec79923b338625bbfda3c13fb455a36

                              SHA256

                              1ebeb7f511cea736ab4da734c2dbbb02e0bf896d031b8c5fffd333498026f774

                              SHA512

                              9668763ae270eae2881ec75c99ca2f79d324e3003e24af95359b0f51ae8d6d1a4971884a6bdd3495c5bff6b9f32a57c377a1bcd34e055079835fedeaaa018a18

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582815.TMP

                              Filesize

                              875B

                              MD5

                              d2607353c42e67d9d99288fd8c96c4fb

                              SHA1

                              378ad78cd538c828055fee7ecd371ea8b98f0d78

                              SHA256

                              c5caccb9093590321109be3362f374335b44521a856528d76f43f1ce8f0fc1f0

                              SHA512

                              823bc5cc7b1221449364a5112c86f0539121bd3e45a6e43e4ced727b88963bc6b8b7f56f70a1a497c11c84f4a504f888e3eb6477d7c398be99fbf3c2eac8955e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              e656c1b1836853c3a56d2b87fa79c7cd

                              SHA1

                              9a60dc81fa18ea44aa173d3990f728a7a136eddd

                              SHA256

                              ef018285a1724821eef73e03b4d9b99609953a9459fbb4a2ebcbddb51ae1e689

                              SHA512

                              08c699ccfc10db0f8561154add79353e6a248cad2816e6617f9b3290c53d3c3188dd6a8f373f255f8fb067551efa663e853deefc307970aaea30cbcd909e60fb