0e20aa3d4a4774f420239427a2cb325255192a0740d554ad34fd78b8b4044299

Analysis

max time kernel
84s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JhonNet v6.exe
Size

7.0MB
MD5

3adfa02366559391193babd23572fdd0
SHA1

4345dc7502252a54a91d55670639bcfea8218f76
SHA256

0e20aa3d4a4774f420239427a2cb325255192a0740d554ad34fd78b8b4044299
SHA512

06c980c3bab2b8e1ba3ecc97ab5ab547f97c4bfd474bae3334081cfab80daed71bf21753ba4cd1f715dc03c4ef6a43c1d45ab4a249fb5e15a58880da7677ef01
SSDEEP

196608:kw6rQZwpk1/OpukB6J+IalYVGf4pa1JNEjlcXdW:1wi6GRqJf4pa1JNBN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
3692	msedge.exe
3692	msedge.exe
2692	identity_helper.exe
2692	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2004	3692	msedge.exe	100
PID 3692 wrote to memory of 2004	3692	msedge.exe	100
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 1424	3692	msedge.exe	102
PID 3692 wrote to memory of 2848	3692	msedge.exe	101
PID 3692 wrote to memory of 2848	3692	msedge.exe	101
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103
PID 3692 wrote to memory of 4248	3692	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\JhonNet v6.exe
"C:\Users\Admin\AppData\Local\Temp\JhonNet v6.exe"
1⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd75d46f8,0x7fffd75d4708,0x7fffd75d4718
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16445488794314508974,15797786215122734488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37c9de8fea5e23a82dc2ba9dab9731ea

SHA1
22faf5795bf2380a811ade5ad0e2779bcaff6b64

SHA256
12c62e57cc2d2483f2924e030617adef2041d6a5fd7bef6e1e54b6594c6558c1

SHA512
efaf20c17af6fba7c55f1d2b0775869ece14cef91a875876741b23a1b4ef9af2f8c6e77f7b463c65d7da0c59399676988dd7870c9a0689008f9a543762925823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
042fcae29dc2afd79d5ee34d9ce096ab

SHA1
32f868665c1030c4f9d38a21b96ce95e850442c7

SHA256
fd3a83d2cd300bf12aca173a73402d869ed4fc7457d094f604106d768b662322

SHA512
afa1edc97a75d61c452a50a4e10a06a984e25689d243df3e0fff7d319cf2bbb3b2a76ed20994bf5480d7fe55642ee92369ced196a0be362fb45635e86ff96ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee58dd4127d1910c00e301a95f4cafcf

SHA1
52ff752218ceef5e458246b89cd29cdbf8283bb4

SHA256
67ff76ff66792885b4318b6e78fcacbf334e03c7b52d204137768d957dcff1aa

SHA512
6c3dbfb97197b87152f349282ab7608b64cc46988a647b21b5990bc79bfbda36e9d1b5178be1a926265b097e622ee4c4ebba009146f7b4cc65dd5ca3ed49893c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e30c85e11662c72f5eb0e7c46536ebb1

SHA1
50babbc7a1654047ee4a2ead6071854b049b2756

SHA256
c0079ffb230b34622539e167cd22187ce0a27c6b2490f5e9a87e4504b8661a23

SHA512
473f1be26d1a74e8aad70cc3bdebd83d56029e08a09df37934916810c3c312f85449e199984685d4344cd8e44177b04c7a5e198cca65af9a6098e62c38d112e3

Download Submit