hxxp://185[.]172[.]128[.]32/cp[.]exe

Analysis

max time kernel
31s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://185.172.128.32/cp.exe
Sample231223-p61vfache7

Score

8^/10

vmprotect

Malware Config

Signatures

Downloads MZ/PE file

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0008000000023230-75.dat	vmprotect

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 814402.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
744	msedge.exe
744	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3784	744	msedge.exe	88
PID 744 wrote to memory of 3784	744	msedge.exe	88
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 3716	744	msedge.exe	89
PID 744 wrote to memory of 4700	744	msedge.exe	90
PID 744 wrote to memory of 4700	744	msedge.exe	90
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91
PID 744 wrote to memory of 4468	744	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://185.172.128.32/cp.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c83446f8,0x7ff8c8344708,0x7ff8c8344718
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,18301448383919480893,16410082868559989302,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921
MD5 d5564ccbd62bac229941d2812fc4bfba
SHA1 0483f8496225a0f2ca0d2151fab40e8f4f61ab6d
SHA512 300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 482584481f8c2d197451f581c79f9047ea76e657407bbce031d1651f6f28b8ff
MD5 0a81d868dc4746a5012ba33623a6dccf
SHA1 eb06857b91318d175c91def42072539a14764513
SHA512 aa226380d238e9b052bd793de6191882d41a1010854ead8d5133ec04dc0f7f996d3896b357700e675fb2bebd803c41be942b18b6c396eb17c341451ddf10b7cf
SSDEEP 96:nZkIYgm/rQYmqn17cwpvWMoiVmdeHYqYUWQyV+VDCzia:nZkRwkBcGWMXsrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d28a0b9b9ed04ea57383bd59205c043d519d47671b99e1306c751d25499447fe
MD5 5f17ed1f767ab81735dea5af35c026a1
SHA1 d53915e12022d6eafceed74a61b4e0554038eabc
SHA512 44dd52605e5077d8fb4a89f415e042474eb7a9952b5324057f979f88f5f5c77730d3e0c2257466e799c3360369816c0474840139727cb55dc4e5a77455e7365f
SSDEEP 96:nzk8sQSYgm/rnmqn17cwpvWMoiVmdeHYqYUWQyV+VD7AiEwb:nzksSkBcGWMXsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18
MD5 1d1c7c7f0b54eb8ba4177f9e91af9dce
SHA1 2b0f0ceb9a374fec8258679c2a039fbce4aff396
SHA512 4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2
SSDEEP 768:n9OWIs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmLlOorUJUPS:n9OWIsu1jafL0JUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 55144b32cc363bba2c00a7e769b727fb5a94c19357198089f78e7df2e174cf13
MD5 cd890bd5c83579e6957deb31eb567b3a
SHA1 d6cff7a39b99a48abc515e33647af659b6589829
SHA512 e57abd2b985aafaf8409f66d3c9c7fd26edfd9ddcabfa0e53c0589cd6e11a5d40b553f1b0935dd8ff0dffe4334f315e0b0399d0d300565425a070e3b2063c43b
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyhiKe2RUOcfKb60E0LQNkk:N9iIxuERzA83h09RZxYyRWbWGR6DI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 814402.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 814402.crdownload
Size 2.6MB
SHA256 66aa220778b2dc7940e035bd5990f44e014c28a7c4bb235d99c85db3c88c2c10
MD5 313178fd581c72985e927b129f2da04e
SHA1 3e0e118c9aa68904eb92b1936eed873f563a76cf
SHA512 70113d8db36d1888d734f3dc87b99d45b1315a1189e47856e2ef378fa31761de0e7a53690ef75520d8a1124be7ee538d4db7f2636f5f36c53e7be8b8cc67c299
SSDEEP 49152:YSlzfx55+ReityViG8dJ9kRg5yfafgKD0ZpY4br0P0QMZim/TiQaYgVJFdPSanp:zl95YReQ2RgCafgakYfmZiWrwpdXp
MD5 SHA1 SHA512 SSDEEP

Submit Download