220f1f227e822d3d62141d976f08ec6ae983b46874ac22b038b01c8c421e0865

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

400963319c578c293465096c3ad3ca85.exe
Size

218KB
MD5

400963319c578c293465096c3ad3ca85
SHA1

b4cd6efc9e31ede02a96c80dfe27b2f89aaa0d67
SHA256

220f1f227e822d3d62141d976f08ec6ae983b46874ac22b038b01c8c421e0865
SHA512

c06ad99e8221cc11d407d4700547959a4f3c25653e0937f8d1f41f13e3698b2f4cb6d813546223fc2d293197c591506a63e2af8779625ce7a72b9affeae79437
SSDEEP

6144:bTnjnvrDiMNb1LSlZCgb5OQx0MciQGKAabe9RMJGtkoc2:bHn3dtYb5O0ci1+kRMboc2

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-0-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral2/memory/4420-1-0x0000000000400000-0x0000000000489000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
2476	msedge.exe
2476	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4420	400963319c578c293465096c3ad3ca85.exe
4420	400963319c578c293465096c3ad3ca85.exe
4420	400963319c578c293465096c3ad3ca85.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4420	400963319c578c293465096c3ad3ca85.exe
4420	400963319c578c293465096c3ad3ca85.exe
4420	400963319c578c293465096c3ad3ca85.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4100	4420	400963319c578c293465096c3ad3ca85.exe	87
PID 4420 wrote to memory of 4100	4420	400963319c578c293465096c3ad3ca85.exe	87
PID 4420 wrote to memory of 4100	4420	400963319c578c293465096c3ad3ca85.exe	87
PID 2404 wrote to memory of 2476	2404	explorer.exe	90
PID 2404 wrote to memory of 2476	2404	explorer.exe	90
PID 2476 wrote to memory of 4936	2476	msedge.exe	92
PID 2476 wrote to memory of 4936	2476	msedge.exe	92
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 1036	2476	msedge.exe	94
PID 2476 wrote to memory of 3656	2476	msedge.exe	95
PID 2476 wrote to memory of 3656	2476	msedge.exe	95
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96
PID 2476 wrote to memory of 1412	2476	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\400963319c578c293465096c3ad3ca85.exe
"C:\Users\Admin\AppData\Local\Temp\400963319c578c293465096c3ad3ca85.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://x.azjmp.com/0bSzC
  2⤵
  PID:4100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://x.azjmp.com/0bSzC
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff817ad46f8,0x7ff817ad4708,0x7ff817ad4718
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,306113275105490259,18067267788007472799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf831d6a062f78788230ea56d25b60f2

SHA1
f429abc34f2af87e16ff328e42f62456abb50e1b

SHA256
bd3a371eef3e93dc985b27147f6c260f47f0dbd95aa53d3cae33aed66e62aa65

SHA512
fffc519badbfaf9a8fb5d02a39ddedbbc06cc7ba8fd292976b9c7dd39895d07f2b8b9d8ec86e41ee75911f1121b670b32098f3f54a1beedd6ee8d736def6537f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
71cb4eb1f8649c892e4fb0bbdc4b330f

SHA1
6198d869b7709f1ddf143f6eac4cb8a452ca36e9

SHA256
8c761ac901579da67d526f856bcebd521e1017e402f1aa66ede94c692a4a27b0

SHA512
709b4c33827f1d039c12d1015111d55ab7d8106e33a54bd2ec3480d7a3026f42d8caaa357c0ad946aa6db3ec69d928d650e24b8ae548b8eceb1086a41c6764a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aef1498cdb747f5f18ac7c9da4fbd886

SHA1
f9d760cceec6e6b5c6b80db54324bf04643f6e6c

SHA256
bd187fda268a735f7545d3fd45c0772fbddfc6220ef1d70d52e42e4a990580e0

SHA512
93fd41c2aece5b78aec9b5a2f0bb3b21ea661d42cc91f595f96a03ca99f04715c1a6915836e47de326d1bbdb26a5f06ab907cc888c0c3068205413dcab8a8045

Download Submit
memory/4420-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4420-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download