19ae41882b38301512578b751e0d458fed634ecc93b8bdc82332dc241f976b63

Analysis

max time kernel
162s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

472648ade97c7f5542b65b5008bb00e2.exe
Size

1.8MB
MD5

472648ade97c7f5542b65b5008bb00e2
SHA1

2050bf8fad1b732da952f01743916ae46c495c96
SHA256

19ae41882b38301512578b751e0d458fed634ecc93b8bdc82332dc241f976b63
SHA512

77445477a1e4fe3bf6ed3e3e00de9ac1d5998421799fbefff2c28fe44a0719b1e81a5e5af6d868f9e020f6ccff4fe949347e35f7ae21b878f9ad9f45328efe2b
SSDEEP

24576:LI9KiBm6cIRynj7gK+dWPo3VwMNqGCckTlcRu1d21LGfrJUtZPh38EouyU:23m6c37g5dHBIG4bm1iJUTPJ1Hh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
512	.472648ade97c7f5542b65b5008bb00e2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
512	.472648ade97c7f5542b65b5008bb00e2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
1688	msedge.exe
1688	msedge.exe
208	identity_helper.exe
208	identity_helper.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3244	472648ade97c7f5542b65b5008bb00e2.exe
3244	472648ade97c7f5542b65b5008bb00e2.exe
3244	472648ade97c7f5542b65b5008bb00e2.exe
3244	472648ade97c7f5542b65b5008bb00e2.exe
512	.472648ade97c7f5542b65b5008bb00e2.exe
512	.472648ade97c7f5542b65b5008bb00e2.exe
512	.472648ade97c7f5542b65b5008bb00e2.exe
512	.472648ade97c7f5542b65b5008bb00e2.exe
512	.472648ade97c7f5542b65b5008bb00e2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 512	3244	472648ade97c7f5542b65b5008bb00e2.exe	91
PID 3244 wrote to memory of 512	3244	472648ade97c7f5542b65b5008bb00e2.exe	91
PID 3244 wrote to memory of 512	3244	472648ade97c7f5542b65b5008bb00e2.exe	91
PID 3244 wrote to memory of 2292	3244	472648ade97c7f5542b65b5008bb00e2.exe	92
PID 3244 wrote to memory of 2292	3244	472648ade97c7f5542b65b5008bb00e2.exe	92
PID 3244 wrote to memory of 2292	3244	472648ade97c7f5542b65b5008bb00e2.exe	92
PID 4940 wrote to memory of 1688	4940	explorer.exe	95
PID 4940 wrote to memory of 1688	4940	explorer.exe	95
PID 1688 wrote to memory of 4928	1688	msedge.exe	96
PID 1688 wrote to memory of 4928	1688	msedge.exe	96
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4580	1688	msedge.exe	99
PID 1688 wrote to memory of 4236	1688	msedge.exe	97
PID 1688 wrote to memory of 4236	1688	msedge.exe	97
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98
PID 1688 wrote to memory of 5064	1688	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\472648ade97c7f5542b65b5008bb00e2.exe
"C:\Users\Admin\AppData\Local\Temp\472648ade97c7f5542b65b5008bb00e2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\.472648ade97c7f5542b65b5008bb00e2.exe
  C:\Users\Admin\AppData\Local\Temp\.472648ade97c7f5542b65b5008bb00e2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:512
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "http://www.wansf.net"
  2⤵
  PID:2292

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.wansf.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7fff330b46f8,0x7fff330b4708,0x7fff330b4718
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4172 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4172 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,804912833056210218,6727247977216865311,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
memory/512-10-0x0000000000400000-0x000000000084B000-memory.dmp

Filesize
4.3MB

Download
memory/512-11-0x0000000000400000-0x000000000084B000-memory.dmp

Filesize
4.3MB

Download
memory/512-13-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/512-100-0x0000000000400000-0x000000000084B000-memory.dmp

Filesize
4.3MB

Download
memory/512-101-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download