kinsing | hxxps://zaf895[.]com/File[.]zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl

Resubmissions

25-01-2024 15:52

240125-ta3flsbabk 10

25-01-2024 15:51

240125-taqf2sbaap 10

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
25-01-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zaf895.com/File.zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3788	msedge.exe
3788	msedge.exe
4652	msedge.exe
4652	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4652 msedge.exe
4652 msedge.exe
4652 msedge.exe
4652 msedge.exe
4652 msedge.exe
4652 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4652 wrote to memory of 4556	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4556	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 2432	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 3788	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 3788	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe
PID 4652 wrote to memory of 4540	4652	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zaf895.com/File.zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe36f3cb8,0x7fffe36f3cc8,0x7fffe36f3cd8
2⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
2⤵
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,14206651635935331909,2001623456488128761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5584 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bb88128b6b2d63f04c36ce68ed52d0a1

SHA1
29cd0515976a9249fc96a9d77c9986238cd1c2da

SHA256
19341f9fde32349d43cf9951f118ebbff856499e0e6875101eaf2db37a7d7d8b

SHA512
ab3071e116a32fc105a868fe9f3cd11cb282fc6cdc1e101b09c7f6269502f98b34b2f0a2ec32eb2b537073e2b20bd22cefd2fdcd4be87f8b169e6eed3bed1ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
467B

MD5
02a8e346ea7d4d5b07ff7cfd73bf2b70

SHA1
43835df919158402cdd83b809844122fa42f6cc2

SHA256
45f65fa02f23f149253c589ceb8ab3b90ed30794c0fd4072bd2f18de115f9389

SHA512
de5c9522f70393b17eea71665912ada2b711f86aec8579b93ce495d4b543bfdca5ceb1cbbb3554279a54e7e361fac2312914b8cad38f796d7e45e55f4303dd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
178B

MD5
4b903bfca92fa3b11d21a79bbdf72b8f

SHA1
ea0afc5ad96d52ab6b6c5ee3bbdf6fa5d50695ab

SHA256
f18f7c98fd2a4b9e6b7e334330e8e9e417df2c765dfceb29ec417af027a0f1b2

SHA512
6c4b0812cc6ceb9fea8bb9da29f3e08c499eae2692b31214bf66ede6c8c415eed0f1dd2177ab9e430c05cd5b73ac5e8a50253e6664353ba85efd5bcdfabcb0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
3782262c48ea126445f16420743de57c

SHA1
9110640b8b732a79e4335e75c020c00b7ca8f140

SHA256
4564c6d1e57c5c1aaffa2724584c6b9dd243bb085a97e1368d55cca6304b8c6b

SHA512
4ae94ddcafb886d872bb038b2d002ba2807be28cc02413ae6819c9c6ceec102b68c7ffa310558e91ee8ef7497a7e6026a0e38d9ef7df362e5ed81c182f3a5bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
66100b68396278d4b54317ba5eab2c2a

SHA1
84d37fd603e6a23bc60a204c052512ae1b3688cc

SHA256
e4c1876c4c78c45f1b7fc27517e0dbcfab21c362fa49a7aa9892107075889873

SHA512
8af3657fc1584f1754261a6ecff660814055aef0aa7e5b41b8397b0f4956b545f5a544a52227bd3ec4fe6e48615f757890703d103ae9fa6bfc383a7ce947eff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
25KB

MD5
87796f83a580ad1059639b7b6f48c978

SHA1
3aeb3452c1d42aa82dcc46fac0eff546266958ca

SHA256
ca9281ab005e47fe20e132b81ccfbf7a5f0e6d845cd3412129bcb07cacb1397d

SHA512
196d07ff37bf35b583ba80ef92e0277eee328925a77accb3dae1ca10a356a7924f49a7e6233db1b8b320eef6beeb9677ee7d642dd4bcdb2f1343cfe84fb186cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
45f34dae47f4dc17f87430680170f79c

SHA1
d83691f57d167af79b1aa1c3a798ef4d3fb330f4

SHA256
039b57c48d9cb18f04a12bc0804ccc03e4f04bb62e0bf5232dfa78bd5d276fc6

SHA512
c542213399b17e2b5902dcdc85c8344f8d8729e015021b589ba099e35df4a6a1260d670ad15451c0402c62630da75323f244848182b70f4f0445d393391be674

Download Submit
\??\pipe\LOCAL\crashpad_4652_SLZLWYTTWMFKRSEI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit