hxxps://apk[.]tools/details-salud-banrural-6384be7a339085661b58e16a8e052b23-apk/

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://apk.tools/details-salud-banrural-6384be7a339085661b58e16a8e052b23-apk/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
2448	msedge.exe
2448	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 3592	2448	msedge.exe	47
PID 2448 wrote to memory of 3592	2448	msedge.exe	47
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3348	2448	msedge.exe	87
PID 2448 wrote to memory of 3804	2448	msedge.exe	86
PID 2448 wrote to memory of 3804	2448	msedge.exe	86
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88
PID 2448 wrote to memory of 3976	2448	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apk.tools/details-salud-banrural-6384be7a339085661b58e16a8e052b23-apk/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd332446f8,0x7ffd33244708,0x7ffd33244718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9748806573194411636,2191690142051869930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9710445397b82e32105b37cd2e50e93a

SHA1
4fac3fbb4d148c3cb3ebc153d0a4afdcf5122f48

SHA256
017d7079ba91bb4d755f01b91cc5fb894ed8cbeb251b387e95f121b5fb77e4ea

SHA512
412cd529c5450588ac80b40b08b62715b740f2714530d4f3d627f66553124301ccb03184fd578c6fc588f5b3b8b4d5f14f2e0ca2d3adc2a96aab9c126585266f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d168ca4f5af7ea95f1147ca089383cbd

SHA1
0f00b7d99c56daf721b5395fb198f7edf2f6ab2a

SHA256
43ffd30bd8594609e41148ec5e9eeb6bdf9ffac92ed4449cd54b16abbd252847

SHA512
16d026055680c44b8367ef7ea9015c59b8927729cc45fb8b8ee4e3b63331577bd08dcd8e4192ef14a5cd611e9796562ca3024c127e3604901c9474cf71cae41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cee1d73b26ef17643c52206c1fb388fc

SHA1
689316ca8d70e5d138bc1b306eda9b31406d1da8

SHA256
5b6d056b717c99dc88b1ffc0f058a3bcfd19f6e1bcadd1fdd81fa3c0837753b2

SHA512
8e25926e817e0278e39c25be2742f758a63adde34303a3a0f40bfd2345f2565cdef473c89e2db4c5d6483f9bd3fd7f97230c30f834e4175f1a9960550d5456ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44c2d1a6c4fe3743ab736e99687cbb35

SHA1
b1cfcec2ff2a1f8f62e4462d404f482711bdbebe

SHA256
203aaf8a09b5b6dbcfdb0a759d65b63f4e4b9f57db7e7b61b48d52fa08785e0a

SHA512
a2be0476fd398a2d78233d2b98e071a1a410eaacdc8ef0cc1a171a1ec6716a0fd3e9eb1ebbdcdbc583ce882b544b6464190a06748e474a9d1598ed1680c02970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bae68b39194b3bb6ca24e97060adeac

SHA1
fc60c60ebbdf696b4f896559012d00474afc6f89

SHA256
bf2de350db9d6804ecc37a4a610d44effd5585f3951cfa6f1c43ea4a49a2abde

SHA512
02c29bb782a757d1d1404c3b0b67c13d9aaf4181f4fe6f810e0fe8079fdcfb7fb9384dc26fe20c50b65c8407f4b6ae8bf149eec1b69d546633df428d43bd1d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1cfb01d37d17798f22ec54f6ad6d1b0

SHA1
5229dff06e429f5ffb95805e554e2a4e6f2d7768

SHA256
e517d9dd34a30108ed3c4fbccd34545a3ee32d8c7d85596a17168bd31838d0ea

SHA512
3456b627726de8c842ed6650a651005a44cc9509e6b0bdc979d850af8f46cc5ae1ab9cccbdf979dfea52c623dc1b7b848bb6e282cd96ba025db82b930d0dee5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcb5efabaf46f6c0f407d4e3aff75e4d

SHA1
398534ff170975fea16609f13048fefd23bd8cbc

SHA256
0843ab7718d433a78f2ea02b31eb176a9c34016c1579b446358677b7f1d79484

SHA512
14d28ed347404262d32957a2ada4af79f780188387ccd95995fa1187531e6dc2e6d2e7f96cf5e2b6ff48af1941a6ba6a1b36973de008b591def9b351b8ea5d8e

Download Submit