hxxp://kemono[.]su

Analysis

max time kernel
1681s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://kemono.su

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
3992	msedge.exe
3992	msedge.exe
3392	identity_helper.exe
3392	identity_helper.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1380	3992	msedge.exe	66
PID 3992 wrote to memory of 1380	3992	msedge.exe	66
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 2320	3992	msedge.exe	88
PID 3992 wrote to memory of 4288	3992	msedge.exe	89
PID 3992 wrote to memory of 4288	3992	msedge.exe	89
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90
PID 3992 wrote to memory of 2500	3992	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://kemono.su
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe21b46f8,0x7fffe21b4708,0x7fffe21b4718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12813865789055838151,5860152556794910253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
37daaac35d18e7f3e08a2bef3c847d1d

SHA1
8ecd7368391512939a5778f1996f06b589800902

SHA256
2beec3e8dd835846a3e5b5386eb6d02eed625e2f2954da4e7df68ee18af5c653

SHA512
13fcda414b38206b985ea2361826099b44565a14e4ee06dcc1333e218bfb4aae8b6725c377743af9b689e95fd80afb5780d67f2facf95312d598fdf2fae0deac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
177B

MD5
36388ef10734412266c1958f4ef6a517

SHA1
0eed0a803ee347f455d7159f85bfbd9dd2ae022a

SHA256
9e67019c6c9a4f9d20bd0254fe8ba94cce12392b5a07f44d3873a95e416be1c3

SHA512
87ba5ffaafa2fea8d6ebc1725c5d474c8aef9eb30c5b62d8ab19087788b9f923abf6776ca85d00a128ab4830b9f6a0260022269af6f066d9decf11a9c0ff05af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9987626b83e49c0f6e88567ec10e865

SHA1
7c42acbe35d2e7b793b58935643f1dfc1e5c3404

SHA256
0d098bc2cd769662574332561dce050ff23b25252b2954bd840530f6da1907a3

SHA512
9da3355a057e917c1a81a86669b7c6c0bcedb6f50b4584c26519aeb8e6ea44904e4dd3a7ecc120d3fb55a4a0162254add2e7f86ac4b09ecc2aaa7e4a3c12577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0bf865996182f78a927ae5c3f2a916c

SHA1
a09755778cf8ed6dc480282207ec453bae8ea78c

SHA256
f0345b26bf27515f4440223e85949986fce487c94686c98f32df418550ba0431

SHA512
df27a2afad033df028f222a52c7277d59d9d424f12e3f0a80b7351507e51d33c0f85eb82cc23b3fc51f089d3ac23eff8f721c269a59e883c04f935a85cdce7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3503d8b7c4ea1c8a3df137b3c783b83e

SHA1
752116793d3d36c208b5b314e77224c5f97da2a4

SHA256
baa7b48c99ccd5ea6b6d1de1d50551d197407092ba707ba89fadabd7ded45bc8

SHA512
563b2b80ee98b6173fd15e7af1c3d61451aca296154dc00830739767a419a1e0211a8ba849597d9f322dda2b193e84155de3ddffbfaf3eb7d36e5cf77d1077af

Download Submit