hxxps://android-apk[.]org/com[.]banrural[.]hn[.]app/63718711-banrural-app/

Analysis

max time kernel
295s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2023 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://android-apk.org/com.banrural.hn.app/63718711-banrural-app/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
4952	msedge.exe
4952	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 896	4952	msedge.exe	52
PID 4952 wrote to memory of 896	4952	msedge.exe	52
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 908	4952	msedge.exe	85
PID 4952 wrote to memory of 3244	4952	msedge.exe	84
PID 4952 wrote to memory of 3244	4952	msedge.exe	84
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86
PID 4952 wrote to memory of 2744	4952	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://android-apk.org/com.banrural.hn.app/63718711-banrural-app/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb54146f8,0x7ffbb5414708,0x7ffbb5414718
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12177527133562574402,486221336566012942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f7eeebf-2de9-456b-9ad3-092fa3319444.tmp

Filesize
485B

MD5
8165dc12b938a3ddaad773408013887b

SHA1
71ba3ac47408c889550886a45fbf2d90bdb9c209

SHA256
d906cdfd2c699160c692b923d6aa30d188634161262b3f9d7fd24b2258bbaee3

SHA512
dd926dc237029c649ae97b56e5825df714346c3928cc41ac5b7679d2aad28eaf385dd804ff6341e55c37bb694206b1f219b81f441cae8cdd474cb8141c650a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4bf86e463236b1cc60bc0014ffdb121f

SHA1
f144b252588ebcaa89afeb34e1f559f7d852b098

SHA256
eb46744215637ce5921ba8ba5bc07f1eebf5296cd436f0b305fdbdadb2f6a7dd

SHA512
fbb46ce0e1c4a1e5e48c637935203553a152da4f561e5a70e10865f0d304030247c325ab2c02de5e1831c185175b7bac010ecd0ad168c36b6530d4fc999836aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
329c084224f971000f0bb4855113f08a

SHA1
aa73cfd3d248a00c7bcd46fe90a99f664f87ffc2

SHA256
9ec7d0f3d4c99fe61cec989a988a0188a330d54a54d5ab51b3137ef02076d6de

SHA512
3d503ed68236ea41f4b0fd4cfdecee4be9e6805aed1596ab951e831a3f6ec40f440ae8e290c0f35ad984efe4ce9d956118f34fcda4085e266d7a088ae88ce3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3826637072992455a20ccf2d4364f892

SHA1
e980bca02f457e90861c035bdac35d204469cf99

SHA256
769fba7f51e7a8d3180d921299acd8871fcf66da53420e2d3bab4e141fbe46e1

SHA512
6722d1f1b3624c199fb3d12488a445bd4477fbfeaecd013891c04c3a3e3180710b8e29e6762e5b3f03a34f6a92848670ab34227c0b65337202d8348af5dfc5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f4fde64c49f6cad74d968edf7764534

SHA1
8bcd8c3658b7803717b8cbe323bf39a9b8982e9b

SHA256
5fa5d3f87883fdeb59f5a90327c4f78372e1a83c900ce376340d6c5684b1200f

SHA512
baf834f33e39a1848bc6a1a01d06092005369b339e1188eadc9f508a81f425d6a1a3fd7108772c3ca623d60dd594bf2bfcc67651c9ded365a8b3bda9668f58c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34a27c490422f9ee99c9ff714f8f97cf

SHA1
34df9a1ef4f3a2061d25d6260b8d331b49c01079

SHA256
80869e9d10e73c33df092995af6559941709e8a6d515cb8a4cb4d7c9dcd9a5c4

SHA512
b6ea6980a444747a4137e96ffeaec92a2fc50fe1d19543e3c5fbb20b3ba2075f98ad41cc176e6aef003367b7445b4727d7e0b2efe65260148699ca7e582d3654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
567cfb38e146fbe63b73370c30375a64

SHA1
a511980b41e6fe0a3274456e811dd6419669ac99

SHA256
ac636c6ceed9e4e700c5963fe4db8eb9fb889ae777b4d6e0c5f77de2452fdc97

SHA512
31d1e97339a54f075f0f780cd0a4b5584ed598019f9b05ea133d9f017e80246751efb7851274002e9b78aa81d6e0e54b1ca55dc239ab9b6b055f42c29816e161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70c54eeca7c32f9e7a69074cbb358974

SHA1
52dd5a572a2a0417975fafa758e034c5962ce0db

SHA256
358d9dc5e2e0e184b90b54f6fa14a1f2dd5d6927e39b697f6ad746ca5a012e8f

SHA512
5193f8de9e0cf0f148119a245278898f17509ed3f07dfdd1e29cde861e4d87905bb70004803ce965a895a16fff7e9bffe99e53cddc35ae4567465ef45af38733

Download Submit