d6c2048d1222781aa28fa8cd44bb07944fa534b0cddbdf5162cd4c9b0d23937b

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VB程序太平洋.exe
Size

24KB
MD5

a2b0dd7a490c19aca773579858a8d460
SHA1

e39a91ebfddfe0bfa34147eb976a53c013cd39e9
SHA256

9e39a64ddf585f6ace211eb5cdbf43318faee82429479390eb6cb900c53caf6e
SHA512

9f74a23472f215ee6305cbad95cd39cdc617f0ee4fdfd29e95774fd5934eca8030aa288670ba8a6bf2c5bcd28885d27138b8752f07fdaff62349165c5fcec7e7
SSDEEP

96:/lx8Q/KUtRmNuOtJyg4DAfNBmVwq4ehCGsHDhRaeZXSKJEHOtJyg4DAfJtRmN:/TX/bmBKDArQwq3h2CIEuKDAJm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
1168	msedge.exe
1168	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4352	VB程序太平洋.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3604	4352	VB程序太平洋.exe	16
PID 4352 wrote to memory of 3604	4352	VB程序太平洋.exe	16
PID 4352 wrote to memory of 3604	4352	VB程序太平洋.exe	16
PID 3136 wrote to memory of 1168	3136	explorer.exe	24
PID 3136 wrote to memory of 1168	3136	explorer.exe	24
PID 1168 wrote to memory of 3824	1168	msedge.exe	23
PID 1168 wrote to memory of 3824	1168	msedge.exe	23
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 1088	1168	msedge.exe	36
PID 1168 wrote to memory of 3688	1168	msedge.exe	29
PID 1168 wrote to memory of 3688	1168	msedge.exe	29
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30
PID 1168 wrote to memory of 3296	1168	msedge.exe	30

C:\Users\Admin\AppData\Local\Temp\VB程序太平洋.exe
"C:\Users\Admin\AppData\Local\Temp\VB程序太平洋.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.dapha.net/vb
  2⤵
  PID:3604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dapha.net/vb
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5404447242680413530,16144148760276191255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe03b46f8,0x7ffbe03b4708,0x7ffbe03b4718
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e3448b7042ebbbb3c37f5e2a37514cc

SHA1
7066644e8130ad85117c48da3d5d748185c65470

SHA256
c7e9b916619c74b4d1250011f9959de82219b2e93648a64af2a723f9fc2b4587

SHA512
ac5d786f027d61ed079ba48419fa13c4ef141d0ba908ea5765aecf8b3e482cfadbda458e6c15a104083d5ce01f62c4c4213affce5c5e1ab35d687ca5f17c2506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
1KB

MD5
01608ad0771ef15246067858d6a1d6e8

SHA1
a88565c8350bbd10ec251e2e49ab6f24c79b7c8f

SHA256
661ed07ea35fc8e4fbb80253f1d5d27e28753bddc1842a8bd9eb2fff3f8b4cfc

SHA512
e463bda64f5a545ff56854e2333654df9783c0b6b8911585452a9030f70a4254f3475416a982ed66b25189ede616c5883764d74f67c0848a3151890780242a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
318c4e7f6d4884fb7c956d8b6cfffd4b

SHA1
728ea065710f598b85adcb5cc27fc0d1398fa89f

SHA256
5fedf438ba20d8987fe4648a699fc418a5c15e6650803cee189ce2739602e0c0

SHA512
ba2a56facc9347abc384f792501395c755f6a72e692895dd849f16d7257719850cefe7328cc2d421afb5b265de72e37a974bac8b21618eeb996e118659aff028

Download Submit