hxxp://v[.]youku[.]com/v_show/id_XMTM2NDg1NjkwMA==[.]html

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://v.youku.com/v_show/id_XMTM2NDg1NjkwMA==.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1408	msedge.exe
1408	msedge.exe
2780	identity_helper.exe
2780	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1248	1408	msedge.exe	88
PID 1408 wrote to memory of 1248	1408	msedge.exe	88
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1676	1408	msedge.exe	89
PID 1408 wrote to memory of 1044	1408	msedge.exe	90
PID 1408 wrote to memory of 1044	1408	msedge.exe	90
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91
PID 1408 wrote to memory of 4052	1408	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://v.youku.com/v_show/id_XMTM2NDg1NjkwMA==.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdc2a46f8,0x7fffdc2a4708,0x7fffdc2a4718
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9339297654497543025,9045704429034482552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
5e4a850a117106a7e5c2cada0dafe8cf

SHA1
79001da099d27771ce45476225eb24b217d6bc56

SHA256
11e2a8967a46d6dc98ce665e4f1837eef31f680728d65f53ac81b47e5cac3470

SHA512
bc183b4281082a4d40dc429c482c8701574d404031737f0cdb26bf68b77e980abd553c2f1c8fc661efe270cdafd1b63ecb5252803f18df4c730f4b7f3d4d4236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
59b8b9f787afa8a4e9672eb69ebd90a7

SHA1
9bbe2756fcb44d12bfedf8282b41c16a9d1a635a

SHA256
bb3bd0647230bc103e8f2ef27503d060908adcf6901db6bb18df635af137715a

SHA512
05c97e71dc50a0e52997c96b859df41b633467bba174b803defbe6877bd9ced2260d3cdf181426c50e38f5793127951cc5a35a00285646ceb2150006c3a5e61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
7475a1fb925abe5a2b9cc92b0e8e1408

SHA1
3358c24d9dd040a0b8d8c12a8b7b3e57270accf1

SHA256
77893f65ba7090d934901aa6237715b4df6d539d24003d5ddf5a830a37e40f84

SHA512
ef3297f8add6a39aa4dc0d7eaa01e7a7f576f670d1211470d8488866ab529568062ae90b04d53e2513f33cf525da3e2bb256d1f7324e194675718194c00537bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4fc0ccf86cdc4be3d7b582bbf9d8da7

SHA1
b8450a728791335d2dac6853fe92f391f77e4f96

SHA256
6df0617052a6f2605a2071fd6a151dec7ae4a1909f5e2fb0c776a71cfcb7ee9c

SHA512
e0d3a48b5254b14fd12545ec722cf9e710670383b1ac2fa20502239e79c3c81a60380e1c648e5cf0a7af4bacb22be30f407cbabe109c14c52c5fcf83e98f68aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e01f44261ba028545504fcd9eb5bf44b

SHA1
fdb47004b3f9945c336681178312f5e0af59e6d3

SHA256
c7b21536adb00d79920f14034ea58cbcad08f78a784ff4de9172c5ebb3ed124d

SHA512
d15947b298ca0e6423379da4ad58aa49dbd175ba5f89097ad6f0aec53c4f25310ef9134efd280294bdff9d26806ee745608a44a17f31de4438eb9ab9e1d194d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
026745e797284f4a6a88c2cf1ea7e3cd

SHA1
9fe6c762ae1842bdffcca554d2a4ce44b993a917

SHA256
f9534a8e0050dca7825697687505152dbe87342d7cf711ccc8713c43c8023af8

SHA512
41d4f7a4ffd92faed8e5cbc5eb9891689b716be002149e771444a374bd3149d540c98b999cd9053a3421b01b97af9c5ba4cdde7831ff44c86c44342ef4dac621

Download Submit