hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

07/03/2024, 17:12

240307-vq9qasgd66 1

07/03/2024, 17:11

07/03/2024, 17:10

07/03/2024, 17:07

07/03/2024, 16:58

07/03/2024, 16:58

07/03/2024, 16:49

07/03/2024, 16:45

Analysis

max time kernel
1681s
max time network
1687s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3712	msedge.exe
3712	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
4416	msedge.exe
4416	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 4364	3712	msedge.exe	78
PID 3712 wrote to memory of 4364	3712	msedge.exe	78
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 2556	3712	msedge.exe	79
PID 3712 wrote to memory of 3020	3712	msedge.exe	80
PID 3712 wrote to memory of 3020	3712	msedge.exe	80
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81
PID 3712 wrote to memory of 2908	3712	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd657e3cb8,0x7ffd657e3cc8,0x7ffd657e3cd8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13868753157589755888,2270297533681181968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ea84cfc-9180-487d-a224-192d5aa3f568.tmp

Filesize
496B

MD5
21b31e13878cad4219c0155487acd3d4

SHA1
de2d869b9734432c45903e19b030e1b92339e3b1

SHA256
5b105f856e723134813ea2cd576bdb6105e50424c2f72ad3a0ec69d99731dc1e

SHA512
39bbacf5e2c4937475a201ccd598cabb3436ebfaa36588823c4f18e651b1e6a40c332a1e3e4a8bbee313e418d4b0fb01df7f3a74a30c33efa0683101fcf620ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ab9ce61a6e99751254aa2623055aea4c

SHA1
ef12f436280488f7eed576fa81f43554f742e15e

SHA256
bbfa416636a41ed4733484c4a5e2dbd5faecb4dd19f1a0b2c967c718f66ee57e

SHA512
11ed4de920243d00739868b9433174b77152206e07f336ef77782d71152e3dd7be2a1204b828f99a82a6d6968224ecb3296fee8a8e6d16457bd2809f655eef8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
731f90284d701e323120e68267fa0761

SHA1
c554e982c5751adcfac5bcc373a085bff7453335

SHA256
7da37d9ace379ffbda7abcc7ba7e897f12d54e8a47206fbe3141bb3d6b448ba9

SHA512
929e4574b1358a1ab04be34c882eba2c0fbc7606e481ec338e03b800e15f428ad95b57c9ac854da65d693ee9adccde743fde745dc29c6f30d5eadbd743911e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc50fc65ffd27c2fc5f012a27937d3c0

SHA1
7ea1faf290d4e66eb6db8e9804c5f3b62c5c5daf

SHA256
52ee82798496dff03289152c9148b04f16e1749c909e1ada37d9d9e4f7482e59

SHA512
8738eba70a201a53cb82b279d9e248a535c4c2ecb6790175deca5e29cbb3b4f32d784fc8cd5d8f69257c0803d1df4fd5f99bdcc1833523c99974f634ad1cfd02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1016977d2d0e790b9ad68dd921bf5f3d

SHA1
c5a94439f06e2210a39e59d61aa4a7aa07344cde

SHA256
765c3b730a7693c3ea89c56d5150115e7ee0e8b6d200b350076c450eef5bd744

SHA512
8a575bc33918252e0e439c72ac6ec07b2a8df06239f17b54683aa96e001fb61110c47a0e0c1bdf63c3f0bfaa16d8b91ac19645b8dbc4b8ff4456cdcfc15d9cc9

Download Submit