Analysis

  • max time kernel
    84s
  • max time network
    88s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-11-2023 09:18

General

  • Target

    http://gclnk.com/MrBjn00xpN

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "http://gclnk.com/MrBjn00xpN"
    1⤵
      PID:4436
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3828
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:168
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2568
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4804
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2244
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3648
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3220
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3764

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YZUNXYOV\edgecompatviewlist[1].xml
      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9OBI23T6\ac8b4cfd2fb7e31403ae8ebb2c932ad9a6874276ac8d[1].css
      Filesize

      10KB

      MD5

      2113b6560d12d0fbaafcb9b964364591

      SHA1

      781afbd9b39e0ccfd8f6a5d906a48639b62105e0

      SHA256

      02ed5fedd4d231fd7599d828707a1af9728f3dd33876047b5b045c1cec3f5d02

      SHA512

      78c3d3d5056ca06dfb66cfad0820de44b947859b4f886e21ecc6700ba31ee9b7f51faf45d100e6ae591147382cbf18c79c8b9d42ab2dcd93e4318227bd404a8e

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9OBI23T6\b23f8de3d89a5ed3e329aaad159d1ecbf6fbb8b920c0[1].css
      Filesize

      20KB

      MD5

      76b1bdbafa76a16eb077711e0852240f

      SHA1

      4eeaffc1d6645d958efdf93b127bd345134bdee0

      SHA256

      e72bfd5b2451298de330b65ffbf950c8f830c5d373435f26fce733e1264bef5d

      SHA512

      fa7e4606b736edfc15d42e00dc83e8e4ee20b8b79cd7c10b393d29ad220afb75fcad5b959b51fb37c74ee9970ebf80cd7a75d7e4e8be1bfa8ec3e79d2aca4cd1

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9OBI23T6\css2[1].css
      Filesize

      2KB

      MD5

      525241019eea24058d43d431afaf6518

      SHA1

      80dcd8b2ee9c49c6b73a3fa3d25d08cd3c812e83

      SHA256

      0a60293554915b69fbadf4e67cb23ddb4298badadb1fac0516fd1005240ff47f

      SHA512

      4fddae4f20459ada57d143d34f8011c81bd42bca41e435a70aa53e8ee78b6d4faae0e15197d20c8671b5510e2fac46c96e741410d338b8acbd1a69006ae2110c

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9OBI23T6\jquery.min[1].js
      Filesize

      86KB

      MD5

      220afd743d9e9643852e31a135a9f3ae

      SHA1

      88523924351bac0b5d560fe0c5781e2556e7693d

      SHA256

      0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

      SHA512

      6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H2RPBVWS\d5c5bd1f10075bdf5b3d82c9825f6f23a5ce35b0f391[1].css
      Filesize

      5KB

      MD5

      8e61ebf5e7099224faae3ee61be0e439

      SHA1

      433ff93ebd0872fdb8750569824684eaee0dace1

      SHA256

      f653dbf761adb689f70bdfbc792ae65192e95b544d7e66dce483a4931b4c58e3

      SHA512

      f3a2c5b1471952950aebb30f6da4fdac54eafa8b5fdd66ca3d44171b0eec17a309460f15b22af8cec00da1703b89367db2348b12f0501c0f3ae3d3599040a741

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JMEAHW8E\47a826864f275ef6c0297681f82db4581b83a6029096[1].css
      Filesize

      11KB

      MD5

      dacb80dabfaebd8b5c696ca29bddd59e

      SHA1

      d10bdeb6162bb0591b13799eac711d320958d1c5

      SHA256

      6a13129c52b4af929efe3e1fddeceb315a4f8038ad01c469f8d45d5c19483ac9

      SHA512

      dc812155362dd80a49c903dd65953594c0c75b665425616f203ff77e78499174eb400d9ebbec5b670a46b81c316f166eeed202e6b965f0f02587a49f2ada61f7

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JMEAHW8E\jquery-ui[1].js
      Filesize

      458KB

      MD5

      c811575fd210af968e09caa681917b9b

      SHA1

      0bf0ff43044448711b33453388c3a24d99e6cc9c

      SHA256

      d2f0522008bff05c6434e48ac8f11f7464331436a4d5d96a14a058a81a75c82e

      SHA512

      d2234d9e8dcc96bca55fafb83bb327f87c29ae8433fc296c48be3ef8c9a21a0a4305e14823e75416951eecd6221f56fbbb8c89d44b244a27be7b6bea310f2fd1

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M25FMUYT\3896917ecd8dff3da2a357483f3fa8a7aaabaf4baf70[1].css
      Filesize

      75KB

      MD5

      d75bc33f0e1f113e13918a1574bed89e

      SHA1

      ce9524469a86d2cf429390d9a2b09151906f16f5

      SHA256

      c2815908a70bff8204d9c9dc034dd649f3f560a90112b11ddd5e0e53583bd39c

      SHA512

      151a8dfee28aaf232ed27150be0fd259b3c31f176187caf59ba231d067db9a6886bdf62e9bc73632cedd001847d7168fa2ad598e71b315385f547f899ec7361f

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M25FMUYT\c442e87ba420b0b814299026bebf6b882deba6fe0b73[1].css
      Filesize

      19KB

      MD5

      2727c215f1b26015043511e9735a46f7

      SHA1

      7d1dc9acca9b896d0e880973e33e339188fab602

      SHA256

      dbdcded3c4261a3c9d79cb3cf9e641744ad1f2db504690f3a1a06f6b3893dda4

      SHA512

      dc048227b3c80caf9ba2193d2f58af19745e1c4efb893ed742a8b54c25509072186c9141aa963e0454bbb91dcb3945ff3862ac09cc12471d5e9a357246104708

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BOU2ZSI5\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\W56FADQS\iconfinder-discord-4661587_122459[1].png
      Filesize

      21KB

      MD5

      42c117a6734dfdca1b266867f1164b01

      SHA1

      f038cb8b33a47225c4540f04719ccd9f22fa0850

      SHA256

      a8339635d3443d1224a2fad92d74814febc069e4d9f3847206ab2565229806d7

      SHA512

      e6876f4afb48be7939e21bc72f8600f638fe89a0c12e548a172c24baaa2f920e0f7313a30cdb25f34d4b283abf9654447cae6b0dcfcaafdd6356495fa927d78d

    • memory/2244-212-0x000002D7F7540000-0x000002D7F7542000-memory.dmp
      Filesize

      8KB

    • memory/2244-273-0x000002D7F54A0000-0x000002D7F54A2000-memory.dmp
      Filesize

      8KB

    • memory/2244-180-0x000002D7F5AC0000-0x000002D7F5BC0000-memory.dmp
      Filesize

      1024KB

    • memory/2244-125-0x000002D7E4180000-0x000002D7E4182000-memory.dmp
      Filesize

      8KB

    • memory/2244-205-0x000002D7F7310000-0x000002D7F7312000-memory.dmp
      Filesize

      8KB

    • memory/2244-208-0x000002D7F7330000-0x000002D7F7332000-memory.dmp
      Filesize

      8KB

    • memory/2244-309-0x000002D7F5890000-0x000002D7F5892000-memory.dmp
      Filesize

      8KB

    • memory/2244-217-0x000002D7F7560000-0x000002D7F7562000-memory.dmp
      Filesize

      8KB

    • memory/2244-219-0x000002D7F7650000-0x000002D7F7652000-memory.dmp
      Filesize

      8KB

    • memory/2244-308-0x000002D7F4A00000-0x000002D7F4B00000-memory.dmp
      Filesize

      1024KB

    • memory/2244-293-0x000002D7F5870000-0x000002D7F5872000-memory.dmp
      Filesize

      8KB

    • memory/2244-120-0x000002D7E4110000-0x000002D7E4112000-memory.dmp
      Filesize

      8KB

    • memory/2244-284-0x000002D7F5860000-0x000002D7F5862000-memory.dmp
      Filesize

      8KB

    • memory/2244-259-0x000002D7E3A00000-0x000002D7E3A02000-memory.dmp
      Filesize

      8KB

    • memory/2244-261-0x000002D7E3A10000-0x000002D7E3A12000-memory.dmp
      Filesize

      8KB

    • memory/2244-263-0x000002D7E3A20000-0x000002D7E3A22000-memory.dmp
      Filesize

      8KB

    • memory/2244-131-0x000002D7E41A0000-0x000002D7E41A2000-memory.dmp
      Filesize

      8KB

    • memory/2244-281-0x000002D7E4410000-0x000002D7E4412000-memory.dmp
      Filesize

      8KB

    • memory/2244-277-0x000002D7E3DC0000-0x000002D7E3DC2000-memory.dmp
      Filesize

      8KB

    • memory/3828-35-0x000001CD0B930000-0x000001CD0B932000-memory.dmp
      Filesize

      8KB

    • memory/3828-16-0x000001CD0B820000-0x000001CD0B830000-memory.dmp
      Filesize

      64KB

    • memory/3828-238-0x000001CD11CD0000-0x000001CD11CD1000-memory.dmp
      Filesize

      4KB

    • memory/3828-237-0x000001CD11CC0000-0x000001CD11CC1000-memory.dmp
      Filesize

      4KB

    • memory/3828-0-0x000001CD0B620000-0x000001CD0B630000-memory.dmp
      Filesize

      64KB