hxxps://www[.]mediafire[.]com/file/mmord9qj4r9rsqp/Skies_of_Arcadia_Disc_1[.]rar/file

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-01-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/mmord9qj4r9rsqp/Skies_of_Arcadia_Disc_1.rar/file

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
1328	msedge.exe
1328	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2680	1328	msedge.exe	14
PID 1328 wrote to memory of 2680	1328	msedge.exe	14
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2924	1328	msedge.exe	88
PID 1328 wrote to memory of 2260	1328	msedge.exe	86
PID 1328 wrote to memory of 2260	1328	msedge.exe	86
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87
PID 1328 wrote to memory of 1656	1328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb698046f8,0x7ffb69804708,0x7ffb69804718
1⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/mmord9qj4r9rsqp/Skies_of_Arcadia_Disc_1.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16137798522327568612,3555478963109909821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv KMBGiLC9NUCWZzPSYNxEdA.0.2
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0fca61f888d0f30678adf8f3f15b7ea0

SHA1
57660bc0869a8d7f5edb3633ce95af3b90a6dc89

SHA256
59a2b83e172164db95d4f68f070c4896c74afde76d4ad98993f599cd3a056860

SHA512
bbcd262cc82d0c6e4b0d79a31d2d05ad3568ddee369346712e0d09a7d4adcb782f94647528d71ddcdb1172591932d9ab75c30a8d33c39dc7d8a926debf1fbd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
fe10268f0ff071c410353a3c53191b59

SHA1
7eb934e5aa63c929922e457791121f86c0bb7177

SHA256
3530a09cfb5500026bc8f73765856b3a031765618afe71bd941e6716ed712334

SHA512
8f3a9bb3562a9e302604233003348376d7f049016bab131cd784db3a3fef7d75451347409746043413083f02e71c9ad4816e3bc6193775df390e9191de59967b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0d6824b4753d935334c39dfce548a8db

SHA1
6bd009f9bf10e18bc215879d40daa1b188649787

SHA256
406ae701f7f8f86e9fcae24298f268f4cba1b9a25e9efcc55cb61ac7c7bcdb27

SHA512
c0555993a7b99261f40181066ac7ec71da1c1c5d3bf40b60d4688810b054d4ebfb6a10e85e6aea5ebe4165ff188b48540238fcdaa2e39833568fa64f4d94d24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29f4cf186ad7f9d40f04303246b4e364

SHA1
2b5b07f97eb28385be8d52e8421e020320205373

SHA256
16c76712c9c534c6dae2cad5b98b0a0f5fe0118159f95036263c835e51c677ec

SHA512
81121c818dcae28feb505d4b393d0cd89c7a9f153d0f707a9444be0847bcbcb8bca742c74999a5ade12a8f76261cc3f9edf41c548fa6a7513145251383f54ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8f5ecba8a7045eb5235a0cd683967ffb

SHA1
f7c0b3c065485ffb20d6cb2fad83b52a541a48ef

SHA256
7fb7e38911f9878ac6d15626068dbddd4881c42ea831fcc754726bdab706181e

SHA512
be3130140dece3b4f1ad2f87579b6e81af2fcf83c745cc9fcf1c024298d36200810a9541eddbe146e32b0297abd64bc7a322a5adb01e5483806855b4acaf3f77

Download Submit