Overview

overview

5

Static

static

1

bee movie script

windows10-2004-x64

5

Resubmissions

16/05/2023, 23:26

230516-3e3rlscb3s 1

16/05/2023, 23:26

230516-3ethyada47 1

16/05/2023, 23:18

230516-3aeh8ada35 5

16/05/2023, 23:15

230516-28vgnada28 10

16/05/2023, 23:13

230516-27wnbsca81 1

16/05/2023, 23:10

230516-257mtaca8x 6

Analysis

  • max time kernel
    444s
  • max time network
    432s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2023, 23:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bee movie script

  • Size

    48KB

  • MD5

    82efebf8c7b591240c3fc56307a121a2

  • SHA1

    93ae3d6436613af8a6957db81e1701fbc50de7a8

  • SHA256

    27052339536a08543f16b5fa0deb4ce554a70b697b27ee0143302d7e6ec4fe2f

  • SHA512

    26a776d2c6bbf6c401c0970a04ef7ec83ca3931c2a74e6b19d0d8bb1e84276b5a1c37d0fe00bf0022568e9ad311adffced95dbc50b0c0b0aa6e16a9bde891066

  • SSDEEP

    1536:ijaPW66ps+TjnDPZJ8Gr6JFDhCrXWqfuz0m/+7:imPEs+TjnVJ8hDh6X/2zn+7

Score
5/10
microsoftphishing

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
    phishingmicrosoft
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\bee movie script"
    1⤵
      PID:536
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd9863b9dh853ch4f95h8267hf398023a3b9d
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffade4c46f8,0x7ffade4c4708,0x7ffade4c4718
        2⤵
          PID:4320
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8047219483936393492,9978157209843559766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
          2⤵
            PID:2020
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,8047219483936393492,9978157209843559766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,8047219483936393492,9978157209843559766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
            2⤵
              PID:3152
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:1196
            • C:\Windows\system32\wwahost.exe
              "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
              1⤵
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4548
            • C:\Windows\system32\SystemSettingsAdminFlows.exe
              "C:\Windows\system32\SystemSettingsAdminFlows.exe" EditUser S-1-5-21-144354903-2550862337-1367551827-1001
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:6104
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x0 /state0:0xa3956855 /state1:0x41c64e6d
              1⤵
              • Modifies data under HKEY_USERS
              • Suspicious use of SetWindowsHookEx
              PID:1708

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              Filesize

              152B

              MD5

              462f3c1360a4b5e319363930bc4806f6

              SHA1

              9ba5e43d833c284b89519423f6b6dab5a859a8d0

              SHA256

              fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

              SHA512

              5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
              Filesize

              70KB

              MD5

              e5e3377341056643b0494b6842c0b544

              SHA1

              d53fd8e256ec9d5cef8ef5387872e544a2df9108

              SHA256

              e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

              SHA512

              83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
              Filesize

              2KB

              MD5

              cb8540bde339d45733458a0cfa8caff0

              SHA1

              cbad1a6d46476efd5f1258711edd223fe3a1102d

              SHA256

              90658edd1f1723bb4299d96456c6ac337a522376f8ebee0c1c6510a0e6b29b29

              SHA512

              9b6b83ab4869eea5ed0ee5e3a4f713a863ef1bed1987340de3e3898be31b12a6b6e407201e49e8cdada4e559d5f3c6ee8eff34151fad7a42a0900a850c8673f0

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
              Filesize

              61B

              MD5

              4df4574bfbb7e0b0bc56c2c9b12b6c47

              SHA1

              81efcbd3e3da8221444a21f45305af6fa4b71907

              SHA256

              e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

              SHA512

              78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
              Filesize

              3KB

              MD5

              f6a295952c37e7037070a4ab7a13b03e

              SHA1

              924b749ddf7b5a41e69f83a09c2ce9c89fb7f4dc

              SHA256

              420c14e309211bb724ac2e8fb1db617f58167f66f3c23644b2f7bca14217bb5f

              SHA512

              7915b5a9336cdf2b55f5ebbfb0990c3d4d99e7150e037a9097378cb4e68e5b501c6f2574ba713b817c30a134bf8d0ebfd0c5c8f30ff8b27eae3d186bc709848e

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
              Filesize

              3KB

              MD5

              df2564a1e0765adecf85837081fd41a3

              SHA1

              a121664fa7c9d7ce563d79475e003797bf422910

              SHA256

              d2ca8b16265eb502e3fd99d6c49d8671cbd63c3a67c366518e65b5c35b07bc03

              SHA512

              c50ddf41bd849df82d61b4dac95350b3c39ebdcdd4ec8014f0e7c86bb822c63ed0ef60f7fedffe160724ad063c6d1b84681ddc05e9c1941d0ece8151dfca7e03

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\8QFPQKZN\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg
              Filesize

              3KB

              MD5

              ee5c8d9fb6248c938fd0dc19370e90bd

              SHA1

              d01a22720918b781338b5bbf9202b241a5f99ee4

              SHA256

              04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

              SHA512

              c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\B12T16H1\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg
              Filesize

              1KB

              MD5

              bc3d32a696895f78c19df6c717586a5d

              SHA1

              9191cb156a30a3ed79c44c0a16c95159e8ff689d

              SHA256

              0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

              SHA512

              8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RDU5LGRK\account.live[1].xml
              Filesize

              13B

              MD5

              c1ddea3ef6bbef3e7060a1a9ad89e4c5

              SHA1

              35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

              SHA256

              b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

              SHA512

              6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

              Download Submit

            • memory/4548-402-0x0000020925C30000-0x0000020925D30000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-406-0x0000020925E40000-0x0000020925F40000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-430-0x0000020928590000-0x0000020928690000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-433-0x0000020928590000-0x0000020928690000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-400-0x0000020925C30000-0x0000020925D30000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-683-0x0000020925C30000-0x0000020925D30000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-686-0x0000020913D00000-0x0000020913E00000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-796-0x0000020926360000-0x0000020926460000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4548-396-0x0000020915820000-0x0000020915840000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4548-317-0x0000020900B10000-0x0000020900B30000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4548-1368-0x0000020935320000-0x0000020935340000-memory.dmp

              Filesize

              128KB

              Download