Analysis

  • max time kernel
    137s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 15:18

General

  • Target

    a97b6c32fe3d7cc904cfd21944c7edcf.exe

  • Size

    424KB

  • MD5

    a97b6c32fe3d7cc904cfd21944c7edcf

  • SHA1

    34f08b34b23163ac92453271c45838bc6f3af5e6

  • SHA256

    0d107e35ad72bf13ae737bbde9f010807decfed77d76195966ca28a09de2f1d5

  • SHA512

    62d8fa65936a9cedc30fbae7c30353249ac0857462fdf24c4b70467477336ad5ca463fc489fa87ad1c5f8b975a8340ea332b9c5913bfa66aaba8778066a7db5d

  • SSDEEP

    6144:ceYfD7s6tgQSmI57YFFKu4dWcxKohCzxeFxub15c7ds1yAOGHeBY:ceR6tfSmI50FKum6eFxub15cRxoHcY

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97b6c32fe3d7cc904cfd21944c7edcf.exe
    "C:\Users\Admin\AppData\Local\Temp\a97b6c32fe3d7cc904cfd21944c7edcf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/axstin/rbxfpsunlocker/releases
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce56b46f8,0x7ffce56b4708,0x7ffce56b4718
        3⤵
          PID:2756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1324
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
          3⤵
            PID:4144
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
            3⤵
              PID:3936
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              3⤵
                PID:4800
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                3⤵
                  PID:2084
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
                  3⤵
                    PID:4424
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4980
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                    3⤵
                      PID:5116
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                      3⤵
                        PID:2288
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                        3⤵
                          PID:5056
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                          3⤵
                            PID:4836
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2488
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:948
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2912

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594

                            Filesize

                            312B

                            MD5

                            3ef4efc4cd3d5a7618f403f5c99eb63f

                            SHA1

                            62d77b8c3a51a1ce774364257255e33609f5cb4a

                            SHA256

                            d75419b6f53917b302c4bdb19deaecb18473fe773f3aee25af20fdade65a4e12

                            SHA512

                            cb910fb42801b2aff93303f5df7b1974df45c16b6a98dae982f3bba90a4770f3f7fd5ff9e916be36c5572ddc84023a3f84ae904bce76706cd849ad531113aef1

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                            Filesize

                            471B

                            MD5

                            6520129df625246b2b9a7f7551ddda75

                            SHA1

                            db7f5396646534903f752544a3601f6d41047257

                            SHA256

                            a7ee4c4e5e20601041e975ffce77ea90de35e4f9d008064737fac1954867e832

                            SHA512

                            dd09f5e818904c9b9ebab74d9106a2ad75224eea1f677ef2d40dfaf7f63077a1979092562dead6219693e76c59ee846a579065e4e7a30ef2b7f281693656982f

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594

                            Filesize

                            400B

                            MD5

                            2a83d52d107bb3845e173bf8af76aaf1

                            SHA1

                            027f0dd739840b5209dc295053682ecc1432f7d7

                            SHA256

                            3f5729a2c5a235f03eb58ccaeae7ae530c1a4147d879f4f372752eb78f239991

                            SHA512

                            00bf0125a2f7fd6be6400308aa22c86e7d157e6ffafad92e1d5196fd3afe4f77fe9ccaf42e0725b98deba4b82dc70f094d51bad88bf65b7cb372fc9016272524

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                            Filesize

                            404B

                            MD5

                            5f06283e8ae03157dcd2608b0fbec368

                            SHA1

                            5ce26891abb5cb271750d5a9a3de1de817bb5723

                            SHA256

                            6ebed3dce4cd283a346cbb045bf42d0a4d168b507a3a58070ddc59a092b85fb9

                            SHA512

                            244e35acd4cf3cdc0ae5657df969a74f580bab6254d54f00ad6a962229909bf63a8a1889c195e55cd112464c7e9235c637ed22e3af4812d1fe2600a8293ad41e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            e1b45169ebca0dceadb0f45697799d62

                            SHA1

                            803604277318898e6f5c6fb92270ca83b5609cd5

                            SHA256

                            4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

                            SHA512

                            357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            9ffb5f81e8eccd0963c46cbfea1abc20

                            SHA1

                            a02a610afd3543de215565bc488a4343bb5c1a59

                            SHA256

                            3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

                            SHA512

                            2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            1KB

                            MD5

                            bac1ce6b35291124985c62211fb043eb

                            SHA1

                            2d9948e82e6c8a9fc444f1f94781e557cf99c030

                            SHA256

                            25513842bfc631db3c7f7ae0207fd50b5a22dec703c6d49831ff2f0aa0e8f558

                            SHA512

                            d21c26e70f88d6404d45ff6a475adb65b8db529842a7e30981987b6df2963df38141bdca0463d926c6445b17bb3f41b775ce1db8ffef5e6ec6f8ba16ebf972d9

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            496B

                            MD5

                            d4c46ae160e47b8e5638323df0eddd80

                            SHA1

                            5a0f0cf97f9ffdf00ef86177ed74c27acccc7054

                            SHA256

                            9ecae06af7ccb6ec9a8826d37b6fd2ca90a7b58c2daf84497b582141db80b4f1

                            SHA512

                            056a890b5555af784a7c350bb8dc5ce62c818fbeb61a0ce4ef91396683d6b774db960cebdc1da55ddaa671631c733aeb30393ac588afd8a2d71d4914846666f4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            4ea3c781f4420196096fc53de1c04f14

                            SHA1

                            55bbe11c5f89223cbcbaac4374f695cd36976494

                            SHA256

                            bc5928348911763ccc49845acf79c8bb45568fb0f887a4fc0c82353c56432df3

                            SHA512

                            22428f1f17c6feb79267d73d77bb35b86590c5d129f8fde16f870233c39a86aaeb3f67e362f1d86b381ea95f7245ea7822fc16c8b6e4bb783280b64773324507

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            7df4f6070ab18d4d2186218d8be3fbf1

                            SHA1

                            348ce6ece44acfef900e9df706943861f4e7f14d

                            SHA256

                            7b93bf338ff443cab06da3a42cf6ee6d2cab1e43d541291a3ad2d0769ad71cbc

                            SHA512

                            e41f728ba63035d12393286ed04ff739c852a8aadc8bdb31a60596e1441412a3658d4dc1c5f018d26b169cbc847af58809e9b64afcfdb3226963e7d455552c25

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            86b7314eda129b1c9ab3c81caa4b0c7b

                            SHA1

                            52b36b4b0bfa1e112e48786a6fd9a6be21c5cc49

                            SHA256

                            f18150c1e53977b308894112e3df256eca2d57e2b030293c99bbc43e8a4b7c66

                            SHA512

                            3eb229502954d783e992adb12260aff43ed1b5788d8429323753a20da860f46a7a7ff3275a516e1dfae8108cda6606bb8e4cffc797a96557061615277e221c6d

                          • \??\pipe\LOCAL\crashpad_4572_BMSJFQQUSOQQBDAN

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e