2307111dc03e8fd42ec4e60b4154209ba2d9be0a82dbfec8df058cf438ce3dda

Analysis

max time kernel
97s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

57c98ea418aa4de5f6df02fd64886c09.exe
Size

112KB
MD5

57c98ea418aa4de5f6df02fd64886c09
SHA1

91d17c8401e72e508a8bb52267ce70402970e9eb
SHA256

2307111dc03e8fd42ec4e60b4154209ba2d9be0a82dbfec8df058cf438ce3dda
SHA512

ceb735302414f39ad9941fe407514a4966f4242c7b77ee17ab98265ea1ccad772932f184cb0a5fc885873381678877fb41ac12e49561b69549ce76beac240e45
SSDEEP

1536:w78bo9LY3TrqeCXl9Kxf98sJZ7c4RvoI00RwmE7D:Na6pklgVfBcuoI0ctE7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	57c98ea418aa4de5f6df02fd64886c09.exe
2888	57c98ea418aa4de5f6df02fd64886c09.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3636	2888	57c98ea418aa4de5f6df02fd64886c09.exe	89
PID 2888 wrote to memory of 3636	2888	57c98ea418aa4de5f6df02fd64886c09.exe	89
PID 3636 wrote to memory of 2928	3636	msedge.exe	90
PID 3636 wrote to memory of 2928	3636	msedge.exe	90
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 1512	3636	msedge.exe	92
PID 3636 wrote to memory of 4760	3636	msedge.exe	91
PID 3636 wrote to memory of 4760	3636	msedge.exe	91
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93
PID 3636 wrote to memory of 4696	3636	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\57c98ea418aa4de5f6df02fd64886c09.exe
"C:\Users\Admin\AppData\Local\Temp\57c98ea418aa4de5f6df02fd64886c09.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.360.cn/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffe362146f8,0x7ffe36214708,0x7ffe36214718
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 /prefetch:8
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 /prefetch:8
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5144023938892126054,17270959589070863985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
    3⤵
    PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
953eb605463b44edce20b03b1dfa0d05

SHA1
f05ba160fb8f670b83355185431430116ae71f4e

SHA256
977497373a2f15be50439bc558ab9505b6ca1dd8eac4993d45d6bf26efb496c5

SHA512
0fa703e0370b917fe499d991d8bac80ad0381767c234b62bafb360f98af99876256af147c2efd346de7d1f03d35f1ca87056bee1e9f446ba2d48b921e5e6d962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
769B

MD5
262b7e6b7273f7966dcf5a378d55023f

SHA1
82c396c96a22970baf6274a585494a2d2fa729ea

SHA256
41be2d37a9dcd4feaecec7ad5696bc4703fc670825de31c50fa73de7eeda1db7

SHA512
5791d436f0f60b0423d8eeaf9a9bdd88bf108ed26911fe99aa5c8545f0ab4625fcfa9587edfbd864e30bbdb35c28cd69d764388238588a2fdb70316cbf31e2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1f0f13f8be6bed89735a6338df8c019

SHA1
73f1c9f8161d5f605259d8c00ce582be7f458a43

SHA256
9f2b83cd0da6fa51ae9f4d0d199f281e4326e856dd1af76e6a2e8cee095ded88

SHA512
86437e12edd1cc0ee53a6c046885b9d67749bb539b640d332b6d78dc8aeba28ed8395b365b2f7969dd9b42d9d2a951b95ba2fa52da9b82954027c8edcb3445d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4764104e92788809a0cf0f149fc8db9

SHA1
7b0604b714bdfa26e79e433da359d91cc45ee18f

SHA256
a418bbb2ae45aa4327164213fce226144ff5b2b7f8876cd3bd0423b052fede2e

SHA512
38b3b381dfcf08c096bf857df1a4dff743a4b28a825c08921e041d6557d0e1bca2598131d0e632e3185c7d6879c16e62574e6a899f2f3bcdba93764bbc745f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dad6661303d35bea98d2d4f7d7d639d5

SHA1
8b9b3e5c2b95c796bf3341c63fcd15139c4d8f10

SHA256
7d23855dbbbf00a2c4f08586c6e29e6ef91329ed2a30be2935e5fbb7925b2e72

SHA512
aa76e3363e07c627dd94728603e82eac2d734841bf108812c1d833576fa9db85e9859b953963d37995dbbe6f034080b349f37baf22715901b47ac8c009d85caf

Download Submit