Resubmissions
29-11-2023 09:10
231129-k5dajafc79 8Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-11-2023 09:10
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bafybeih4psuuf5yoogp7yltwjjidswihbltq6kmy3mjdh3rabnn34rtqn4.ipfs.dweb.link/indexcashmolar.html#[email protected]
Resource
win11-20231128-en
General
-
Target
https://bafybeih4psuuf5yoogp7yltwjjidswihbltq6kmy3mjdh3rabnn34rtqn4.ipfs.dweb.link/indexcashmolar.html#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 4568 msedge.exe 4568 msedge.exe 1316 msedge.exe 1316 msedge.exe 2600 identity_helper.exe 2600 identity_helper.exe 944 msedge.exe 944 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe 1316 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1316 wrote to memory of 1004 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1004 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 1268 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 4568 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 4568 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe PID 1316 wrote to memory of 3864 1316 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bafybeih4psuuf5yoogp7yltwjjidswihbltq6kmy3mjdh3rabnn34rtqn4.ipfs.dweb.link/indexcashmolar.html#[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8c0d43cb8,0x7ff8c0d43cc8,0x7ff8c0d43cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,17691861685538036385,1420966678874127207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56e126312d2ac3e6411def860af3effb5
SHA10bafa7fa6e6ff58c03f90e7be34f176d2fa6482d
SHA25666d8cd3d3710122eb73a2991cd38b5b9eb0b84a7479d9a18aae674489cd4b45b
SHA512f0770e3e4c9f0e9160aec628ba7771a76d6761119c12541775fdf4578d185b04ed3c87537e4e43a717dfd8dd152e35aa4b1ddb92ff00667aa74a56877dd21a53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD54c64f2328d61b6274a555bbb5002f506
SHA12eae81ff323c83d3f4a2ba283ec51bc795e30a61
SHA25646e9aaee353d836bad350a23dbbd493980718fa777bf5d3e5f6484ad25b1ef34
SHA512f91e29cbad104f6c3a0ee7e6c995106429672060796c502f8985f29eee9dd32784e56268de0b6ce0c715ace2a9cbb7eaf54f10e8b100252464f70a32796269f3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5f1bd3837e2d8ceed04fa744dc46f16b9
SHA113657706912855f83597b62ec32b731f3a97a7ad
SHA256a32401b510465bc1ec21bda73ef52fdf3668d806cf52324a53544094dce515b9
SHA51264e13ef7489bb9c4ba4140856091940bec520e339e4cd37742126d4d7cce1dbffe5e2770a28788cd3664c8eb245cd05ab2bd29af3855d7b019db1da47cb9b6c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5376ccc6b7dab0e7e82ac008ef3348b99
SHA153835eca416704c5316fd0c7f1084f18d6f642bc
SHA2565351f31257f9afc60c9f40078f3345ce45b565ac63262612e30b53f20f1a9850
SHA5125619e82821036bb52e4aab33876f66a91971df018149584f8847633c99a79addac42ce9a3fbf7a22ef1d57f65dfdaa8fb0462a97e28f37b7ec04c33e168ad706
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56647d9e810f4097fe68f17d445d84870
SHA10de972142413adf2e571263eb17ac502c824a68b
SHA25672601f817d2875a5721e362b22e1121d6e6037aefa6ea048f025e9a46fe4d273
SHA512ecb404e2224674eda4847e9ea3bda17930fd8157868020e8958d4bf6bdf83510f7713ee6904477f9d18f3116a946a7dd705626f821de7c2d5dee3f5cec2e22c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD5590a4be82ce0e7f8c69b0a547a8ed945
SHA1062639b7a6e192a2587e55c8463dfd1173a25c0a
SHA256e5e00d40a7698d1436f72cfaf14a43372bfad5c71ae3737e8131e4662628dbbb
SHA512eb91a8f98ed3ff1a7e3ff65ff94cdecead42f31aca2ba25b9edaa5dab948a83bb2566a99f3237659eba753917d283d18ee3286da4150f47d4297b99a979472f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5816e4c395311c63ee6c4441c7c1d7ffc
SHA1df0639a26d262379456a7af31b85239c64302687
SHA256b11e823fb4df046b2f9f8840fd9379b30ef6063d0740b2141632fb95db416ed0
SHA512ed6c5d815e4f6712aa2604d5e1c667522b2772e463b8ed8f6aab27e5266677f3282b4e1a7cfef3563cec3a3dba3e5d136e3d3fa45fdb15eb33f9a41ec3faf9d8
-
\??\pipe\LOCAL\crashpad_1316_TKUQQCTQWIWJVAIHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e