71de08d14b90196b02293ddca105dc367837280bee2224815e35ff7f17363c48

Analysis

max time kernel
1784s
max time network
1789s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
25/01/2024, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/uninstall_fc.exe
Size

59KB
MD5

9b5a8a1e1a13cb6f5d344cf5f92866f9
SHA1

db6e74fa5b1abbd8a412e21b437d03d173617bf9
SHA256

9c3e4cbf323170eaf1d82a59496557f8013b65d0853bb05b7c054f0d5d856889
SHA512

2dfc4dae9f743831e2e67861e5cd5a118a967fdba9b0c2655e9e71614fa76762b3fcc175feb98c7801d3f753cfe1156168f9125c905b14c28caa0babb4566aaa
SSDEEP

1536:spgpHzb9dZVX9fHMvG0D3XJzQEyS+EhuL0:6gXdZt9P6D3XJkiU0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2132	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral8/files/0x000300000002a759-4.dat	nsis_installer_1
behavioral8/files/0x000300000002a759-4.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1348	msedge.exe
1348	msedge.exe
3972	identity_helper.exe
3972	identity_helper.exe
4240	msedge.exe
4240	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2132	4736	uninstall_fc.exe	76
PID 4736 wrote to memory of 2132	4736	uninstall_fc.exe	76
PID 4736 wrote to memory of 2132	4736	uninstall_fc.exe	76
PID 2132 wrote to memory of 1348	2132	Au_.exe	77
PID 2132 wrote to memory of 1348	2132	Au_.exe	77
PID 1348 wrote to memory of 2208	1348	msedge.exe	78
PID 1348 wrote to memory of 2208	1348	msedge.exe	78
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 3616	1348	msedge.exe	80
PID 1348 wrote to memory of 1696	1348	msedge.exe	79
PID 1348 wrote to memory of 1696	1348	msedge.exe	79
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81
PID 1348 wrote to memory of 1904	1348	msedge.exe	81

C:\Users\Admin\AppData\Local\Temp\$TEMP\uninstall_fc.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\uninstall_fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$TEMP\
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cswapper.freshcontacts.com/client/uninstall?client_version=&client_id=
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd77733cb8,0x7ffd77733cc8,0x7ffd77733cd8
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2917959993990471829,15136257132352654265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5764 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d943a8cf4efd126466512b0952309e2a

SHA1
6a2398d0f51bd03726846cf3e63cf057c9089fb4

SHA256
193acec13684c624ad94981200e722c9acaeb9e7b9df41fcd20de8a3169c2302

SHA512
604e55c870302f893ba79432a41da9ba923001ecc7ce764d8372207cc6bcc7a5f7f44f61c14e21415f292d6746a1abe678df3f496b7231b52e571221b8fd1322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
936272e34c503854d7ebbe1cb05042ca

SHA1
b1dab294d05e9be2eb6c1770efb3ed7036b5c381

SHA256
a93378e6817039f9ff0935d125aba06da172a264b53529a4d8219c5845c5ad41

SHA512
416870aea840d091c096172cb73d62111fbe3bfd88e8ecafcb9823a739646ea7775a46d7b77a2c8659fd09a19a07077a385854f90a53601239feceef0890dd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab2b4b8e65b6738242284ab9448c5297

SHA1
ea14bc90fbbc6a9b07f6bf81bbb3767a671815ed

SHA256
e7188ba8183faa6962d90b9744edd41582c15376d8cbd595230243a0227b0e53

SHA512
b297992d8250dd4aedd7b058a13696051b01ee44f7756fc95ee6d28a06dd8936811d8141afc61e6dd13139bc031597eb48e76747989ef755f8a000f2092c193e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
96ef0380c97220c7a8bd1e84aa6a93a5

SHA1
4c568f3cecb9e5eb89538dd1fe6a5be7a6e4c97c

SHA256
653afbc13bfdf41960d635f702c4006da53e2379b3b05e5897543e2706400827

SHA512
8177f441bb32d965773f0448bf8b463783c66e18b6482187d656f959ff83f53cda4deaca768f0900221654f4211f6f26be7f652567b0b7b3b720dcd365bbac21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b69e1469f94133a7929dc04405c50a1

SHA1
4c06ab39ef429861e36ee04ab4493c708b07b609

SHA256
3758bc0050daf6ffbc50a214433121d6c3eb68b6af74694fc9295d981cf60e1d

SHA512
60e280f5ac7a57038a922d0d926a20445b61046eef64424cde42b3716b3c4a41d74e39ad5507da3d0440237ed987f637ed287f2ee5f4ed396890e5a915c56bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
59KB

MD5
9b5a8a1e1a13cb6f5d344cf5f92866f9

SHA1
db6e74fa5b1abbd8a412e21b437d03d173617bf9

SHA256
9c3e4cbf323170eaf1d82a59496557f8013b65d0853bb05b7c054f0d5d856889

SHA512
2dfc4dae9f743831e2e67861e5cd5a118a967fdba9b0c2655e9e71614fa76762b3fcc175feb98c7801d3f753cfe1156168f9125c905b14c28caa0babb4566aaa

Download Submit