hxxps://www[.]unknowncheats[.]me/forum/downloads[.]php?do=file&id=43613

Resubmissions

24/02/2024, 18:00

240224-wlawvaba4w8

24/02/2024, 17:59

240224-wk5ptsab661

24/02/2024, 17:56

240224-wjc87aaa871

24/02/2024, 17:53

240224-wgrzkaaa561

Analysis

max time kernel
1168s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.unknowncheats.me/forum/downloads.php?do=file&id=43613
Sample240224-wjc87aaa87

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
2576	msedge.exe
2576	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3092	2576	msedge.exe	86
PID 2576 wrote to memory of 3092	2576	msedge.exe	86
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 4496	2576	msedge.exe	88
PID 2576 wrote to memory of 1572	2576	msedge.exe	87
PID 2576 wrote to memory of 1572	2576	msedge.exe	87
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89
PID 2576 wrote to memory of 4028	2576	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.unknowncheats.me/forum/downloads.php?do=file&id=43613
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7fe246f8,0x7ffc7fe24708,0x7ffc7fe24718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16740496371910683732,15341846709258922182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8
MD5 58670ac03d80eb4bd1cec7ac5672d2e8
SHA1 276295d2f9e58fb0b8ef03bd9567227fb94e03f7
SHA512 99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13
MD5 3782686f747f4a85739b170a3898b645
SHA1 81ae1c4fd3d1fddb50b3773e66439367788c219c
SHA512 54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 880ea1d5b11a79e668d70499bd4cef2318dc491fff24e2da44a950dce12d6228
MD5 263dba279efe8cdf62c4a1e1cfaba31e
SHA1 1ea3b63103d08fdb36838fb4b53aa9472843c3d8
SHA512 d4c3f20a3592f48c6f8d3339c4109afcfdf9979ec2f9c5508ba57ede2854549ed141431070efc9ec673b6f46f705069857e211c6c0d2823385c9bc1226c54885
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 c343285f5fd8594617e8b75ac48af918d6371320448a1be0831d88a961a080aa
MD5 d7d832b9d8265507ad211b073247c816
SHA1 34f835ab79eda6e73892909e34176a56a10aa19a
SHA512 2a5aff460644f6f7c458e496ce5acf7f2cd30042317a62d5606864be2e75da8e0bcd2e07d0db47c487c344b3e4a5144f7fadc490585d50192ded4702dc765030
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4788096ae00c9c4d1e6a07ac184886983d5d00c7a25c81f987509d9f1d08fb69
MD5 967d3909da32579e80e702f102ecdd29
SHA1 ed84fe8ae6f048be638aba3d94f8ddb2b4e2930e
SHA512 f943c6834ac018a1830408aca9bf027d9d32013a7fc6d13d34d211a97c492ca579feffc75a9d7dc22fcbb82cd3d52b630947b219232c9d71d9916dfc82eb6e14
SSDEEP 96:nUkPSxm/FQYmqFNL1pGgqwpvWMoiVmdeHlfbOG0rsr2BUWQyV+VD7ziEwb:nUkPPO0TiGWMXlH0gWrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 1f80c8cbefbd2ac86dd92309dc2bd4184bdbf1cf8eb8a743e71840f85d94e453
MD5 10dfdc2b05384f1b602b8498117e2734
SHA1 0356b249cb87891c8c6c80816fcbcf6bb018df5f
SHA512 0c29ea61ad94a705e9c7bdce4887c7f236c5f9856204de9a0b70f99fc7a9bf116aea2bce34f76e564fbd6b0da5c4ce683a5fe8f9386dc26ac847527e97f41614
SSDEEP 192:nUkPPA0TyGWMfuhypgIkOW0a2d19SdqlS0gWrg:nU+vTTWTwColS0gn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4de58da5b2233ba7bfa1f37e2f701386b0aeb7f676c8eca8ad8ce58d2c502d3d
MD5 b03e294b4f3ddea7ac2b846d927122be
SHA1 6b6679e59650c0c4a23f6378c9f2e07240342254
SHA512 0f051c2d45c3ee04f39199c1748006db18724565d094ae6354d39a69f95d2b3c64cc1192589bd35d81cfedef0b3e06f08263f5abcc0e29a6d841baa60d1974bf
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAe2RUAQ69bqE9xUX1MPeuc:A9iIxuERzA83h09RZxYeJQlE9E1MeuB2
MD5 SHA1 SHA512 SSDEEP

Submit Download