2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2023 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
Size

11.5MB
MD5

367754643367215b51b8c62c27d6990a
SHA1

76e2d30b857659b44a3ceb6f7fffc4357ed2de73
SHA256

2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde
SHA512

1ccf22bd426be26ada7a8d19acf79e265b77f344a468eb9e37e15e55ea879ee08817ce33346fac3d99921c1c8a93c9c6ee74b87d62291362294c72fa642afaf3
SSDEEP

196608:m+G0ziAOy1+0ziAOy1e0ziAOy1+0ziAOy1H:dG0ei1+0ei1e0ei1+0ei1H

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4436	msedge.exe
4436	msedge.exe
4100	identity_helper.exe
4100	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4436	4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe	85
PID 4512 wrote to memory of 4436	4512	2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe	85
PID 4436 wrote to memory of 3968	4436	msedge.exe	86
PID 4436 wrote to memory of 3968	4436	msedge.exe	86
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 3128	4436	msedge.exe	88
PID 4436 wrote to memory of 4596	4436	msedge.exe	89
PID 4436 wrote to memory of 4596	4436	msedge.exe	89
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90
PID 4436 wrote to memory of 4932	4436	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
"C:\Users\Admin\AppData\Local\Temp\2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://game456.lanzouj.com/b0cxsd4gh
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff9f8a746f8,0x7ff9f8a74708,0x7ff9f8a74718
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16125394918265318981,17576305054108800408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
6b797e58d2efdafd14c3dea8b8a0fd88

SHA1
8ceb92e6c9ea7efd55a0f870a4133c47f9329ca3

SHA256
a8669dbdb4d28ae54a44a18f05aa98d4ab206d5453d4d170b53828ed47f329b6

SHA512
3384d9b1b89f618a0831548b6c9bd07201a81f4fa374bc4bd2b750a97a4e7a2004be83ec4f7da00caf325380acdb07398551d5e80be7f4386691aeff25220e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3a8244dad1bebf8400c5c464327db40

SHA1
c06111ecff4a5c9c0d113e4f025b1d3bf5578017

SHA256
a8755975a6084c62bed56881a6ea7367fed2dc3ff7738b889077fe5103fdfa8f

SHA512
d939df956336e0f53665cc4f6a7d90c1f03386bac3ec9327c8651ac460d1d96df47e27de5b55ed601c364598ddd58b1681793d1cead3a8379a9ea1b88fc3518b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ba25f3130c0b11808902d1362900455

SHA1
8d21ee2234ab7ae7e9250c263ceec644dd9777c4

SHA256
2ba8b966627fab7b2a71b612264a60df73a8c19a04f71402546d2dfc82ca6cfb

SHA512
7d701622fb2254c927478f746f8404a44656c447108c9a5f49bdca022b932a8ba277cef52a6737704c7a433041592bfd16491a95f27fcefdf12f76a019594e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a994e6151de43c9df6227ee4a943748a

SHA1
af5b7f4063e124265ae11e4e73ccd7b681410c5a

SHA256
a977b041e0e19125bad3cf0a1cb3a5e2d209b8954806248ab7faf71775e1fb17

SHA512
525dba457fcad830c2272057e5d707579b3c9ba7e3cdcb8e8e2715799d7c884899ee57c730e58c953eda29f6e18dd4633dd95174d81cad00676f2a78b85580cd

Download Submit