2212fdf2e7374dc0fd48be78b4b1aae202249353332894bd6f0258781aee34aa

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

284aefd07e87dfb016d71d9cb494fa96.exe
Size

13KB
MD5

284aefd07e87dfb016d71d9cb494fa96
SHA1

c627e058da2a4486abd9179dedafd4cb8dbdb5ad
SHA256

2212fdf2e7374dc0fd48be78b4b1aae202249353332894bd6f0258781aee34aa
SHA512

6164a4193a3146aafa48174675a1259407910162feb20eec5a7f5f8cb965c52172884c28aaa6bd1782b938ded931d20c8b537829ae809a97b4cb5f45eac36808
SSDEEP

192:+S4gbgkAN4SJj+bfrJsUwv7E6sGWaUFu7Br9ZCspE+TMIr3/bjOg+vtwJrJN:+S4uI44aJ+7NsAELeME/bjl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4388-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4388-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
620	msedge.exe
620	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	284aefd07e87dfb016d71d9cb494fa96.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 620	4388	Process not Found	23
PID 4388 wrote to memory of 620	4388	Process not Found	23
PID 620 wrote to memory of 2052	620	msedge.exe	22
PID 620 wrote to memory of 2052	620	msedge.exe	22
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1768	620	msedge.exe	32
PID 620 wrote to memory of 1300	620	msedge.exe	31
PID 620 wrote to memory of 1300	620	msedge.exe	31
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30
PID 620 wrote to memory of 1388	620	msedge.exe	30

C:\Users\Admin\AppData\Local\Temp\284aefd07e87dfb016d71d9cb494fa96.exe
"C:\Users\Admin\AppData\Local\Temp\284aefd07e87dfb016d71d9cb494fa96.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ads.eorezo.com/cgi-bin/advert/getads?did=43
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9952849453831980308,16997474956902075602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedca446f8,0x7ffedca44708,0x7ffedca44718
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4388-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download