hxxp://37[.]216[.]193[.]130

Resubmissions

20-08-2023 07:13

230820-h2e9lsdg28 1

20-08-2023 06:56

230820-hqcpcadf57 1

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2023 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://37.216.193.130

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
4364	msedge.exe
4364	msedge.exe
924	identity_helper.exe
924	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5040	4364	msedge.exe	82
PID 4364 wrote to memory of 5040	4364	msedge.exe	82
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 3424	4364	msedge.exe	85
PID 4364 wrote to memory of 2956	4364	msedge.exe	83
PID 4364 wrote to memory of 2956	4364	msedge.exe	83
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84
PID 4364 wrote to memory of 4692	4364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://37.216.193.130
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc057b46f8,0x7ffc057b4708,0x7ffc057b4718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6658116840310091296,6687942297726808181,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a84af88f7f3b6ef20209e4b3821b63f

SHA1
7edcd44a13df1c6637d85b1b9c2c65d8b8d857d1

SHA256
311329e57242867ab573d08d3ccdfc6ac0dd15469403935f9f6020b4fd80e447

SHA512
dfd0312baa990306afd2e26227eb3cfedbe019331c66683b6fa79b60694db71b3373039f33e0c95979a8438c007fa4db025cbb45b547bae8fa041fe932983dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f571a4164c1ded21c9d559f469322b2

SHA1
81c74c2ab0498935c5be8d0b62c02be35e11eb36

SHA256
c64aede654c1b59b8f40472fab86c6f06b5bb14d9e49748a7ccb5bce008b538d

SHA512
d5d31e686dc4cf0a30c93fd35549dfa1c4b9df17bf036ded4698338ee1f5e8aab91a4dd46bc93a19b2c3004687b532ccb6c0044a8480a2d438c7ecaf970a9064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f2742042e776d4ed2f853b4669ee1868

SHA1
0afe5df7e74f700f7f16f0e27a0972edd7e2690b

SHA256
d0a3a613bb90bf38dd23dc1e55572f9579068154deff0300f6cd88f80f080c8c

SHA512
305caf7521bb07aa3da023fdbbb827285827e4c6edc5ffdea30ae58694358e75986e34172f6f6d9c1132df8d9b5c7ee623fbf2670cd5db56c7b8b10a1af94009

Download Submit