hxxp://103[.]178[.]235[.]29/

Analysis

max time kernel
0s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://103.178.235.29/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4416	2908	msedge.exe	14
PID 2908 wrote to memory of 4416	2908	msedge.exe	14
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 1224	2908	msedge.exe	19
PID 2908 wrote to memory of 4460	2908	msedge.exe	29
PID 2908 wrote to memory of 4460	2908	msedge.exe	29
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20
PID 2908 wrote to memory of 3872	2908	msedge.exe	20

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8465046f8,0x7ff846504708,0x7ff846504718
1⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://103.178.235.29/
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2278376731893179193,17432003326311949759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
  2⤵
  PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af2309714f25308bb06479bf5a404cd4

SHA1
b5c81459f0c946053d78e6b8cab542972ffebdf6

SHA256
d1043a4ef39b7f462df5c091b7c7724099f9f045d1e23e5e951bd3649f91d81c

SHA512
2772f64275a749075c48c008fda00e85b54f63f0fee119dc5f6c5cd544eaa5aa64cacef2368165930e01de2f0d412be34fa30df43094d8c7890f3e19bcb7fef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba80848256d8452bcd5226dedca1df77

SHA1
a544c1cabfc4d1e512edfb24ada68864eb87eede

SHA256
5a43b66695221406172cd8d92b623f1f2352c6e0302609eac6e3e222f9992a28

SHA512
741b1f7972fa6690a2b489e430e20fb9f08ecbda207a129bb99621d50bf53327f9fb39a373b879419b22d36ca26e520440d041ba165a5155ddf63566ac4e21af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8e84672f3d9802a5add34bc8ed8b2fd

SHA1
fc4c92cd705a246a856e47a809a54481182c517c

SHA256
0d6862f5e5b73cea3ffc42b22368cf785af4b3d79054f4e8f72e61a3aa62f9bb

SHA512
c23889970cc17442dbdf56f5c3ae19f551e4b16764618cdf6ebc7c38846cf0517fd41429816b927456697df98c92a5f75943421efd78e457ce6074f471143fcb

Download Submit