5fbd4d8e871d0811a2c5333f9fd48364123cf919f03a1ce59969501e09109a8e

Analysis

max time kernel
165s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054f80a12bb212bf720976d5296097a5.exe
Size

219KB
MD5

054f80a12bb212bf720976d5296097a5
SHA1

8a347f66743b34af9dd38031d45708a3b0b98602
SHA256

5fbd4d8e871d0811a2c5333f9fd48364123cf919f03a1ce59969501e09109a8e
SHA512

d4b10321fa2524bab8e414eb91043546861604108a129ef1d3057b293c52153e7b3829bfea2a7cccaf89be1493a72a5333c7b3951afcf1755fb88d22267bbb01
SSDEEP

3072:ExnTsKjMdHMrVR7lJwshdy7LaTS9tyLowTEbKLsdgMDf6c0XbAaQ5UA6VQwAgF4:ce+R7ZmfaTKyy8sdgnpm5P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
1480	identity_helper.exe
1480	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3328	2464	054f80a12bb212bf720976d5296097a5.exe	102
PID 2464 wrote to memory of 3328	2464	054f80a12bb212bf720976d5296097a5.exe	102
PID 3328 wrote to memory of 648	3328	msedge.exe	103
PID 3328 wrote to memory of 648	3328	msedge.exe	103
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 2512	3328	msedge.exe	105
PID 3328 wrote to memory of 3700	3328	msedge.exe	106
PID 3328 wrote to memory of 3700	3328	msedge.exe	106
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107
PID 3328 wrote to memory of 1476	3328	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\054f80a12bb212bf720976d5296097a5.exe
"C:\Users\Admin\AppData\Local\Temp\054f80a12bb212bf720976d5296097a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vivo.com.br/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c2b646f8,0x7ff8c2b64708,0x7ff8c2b64718
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16709827403269570934,6568191137491901232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
beced7619372fce3a839597f781956e6

SHA1
91573e3f9b37e3cbab79e2412863ac7d778dff3c

SHA256
b0986245e330c717a64c197cde569429568a858c936e7ca3c2a301b7f73e379a

SHA512
2d64c71c58e17ca0ee443d86513d502ec1c1c4041aba05b0f161ee96487457572815fb497c504f8998bc6ca6eeb9a6ec96747d74f15f812f6d692bbba195feb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be9a78dc0915c6db046db2f3f7fe4734

SHA1
a3d2c0e77305251b693863a351b81208518d048f

SHA256
f0635d4806a47dcd075e1890a661714e6bed48ad41356825811090489ae05cdd

SHA512
ed01320dcd6eab266be8c455d30fdbc8b3537aee108ce1ff69c4ab0d566ae063ca3264e5d7e8a9112e308c8c6169499100f4003f7ada34888d0813e1e61d1555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6cbacef561a1368df176a963c217a1c

SHA1
6f594333cddf2737f4a39ebe656f51f7dba66635

SHA256
ba74840cdffe79eee6319737c489f14c96e4111fd3122821de2473cc68050912

SHA512
9c1908f42587e8156e1ebc28dce7d387b8b6152cb74b9ceda00d9813f23580b81380ed2a604830f56d1b5c48eec2c6950817010efd73e18af201914a74deb623

Download Submit
memory/2464-5-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2464-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2464-4-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2464-3-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2464-2-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2464-1-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download