Analysis
-
max time kernel
1s -
max time network
5s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/03/2024, 13:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Da2dalus/The-MALWARE-Repo
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://github.com/Da2dalus/The-MALWARE-Repo
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3184 msedge.exe 3184 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 1800 4312 msedge.exe 80 PID 4312 wrote to memory of 1800 4312 msedge.exe 80 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 2176 4312 msedge.exe 82 PID 4312 wrote to memory of 3184 4312 msedge.exe 83 PID 4312 wrote to memory of 3184 4312 msedge.exe 83 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84 PID 4312 wrote to memory of 1096 4312 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc1393cb8,0x7ffdc1393cc8,0x7ffdc1393cd82⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5948541615382875377,16682944617055749034,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,5948541615382875377,16682944617055749034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,5948541615382875377,16682944617055749034,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5948541615382875377,16682944617055749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5948541615382875377,16682944617055749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1652
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d459a8c16562fb3f4b1d7cadaca620aa
SHA17810bf83e8c362e0c69298e8c16964ed48a90d3a
SHA256fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a
SHA51235cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f
-
Filesize
152B
MD5656bb397c72d15efa159441f116440a6
SHA15b57747d6fdd99160af6d3e580114dbbd351921f
SHA256770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab
SHA5125923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c
-
Filesize
5KB
MD57800198331d72fc50eca3eed0e21e48c
SHA16413ae5344d535cd14e64c5ae3e52be8638d5112
SHA256575e5e3470ad2b227a2e9d779df1e8ff7787380f235b24ae564e333efc65bc96
SHA5121eb0a86586ed5c1e8d6c8c9874991b2157a76f7811da2324872b87fd5c3611a76c707be58f2f5adc547a419b88b8e5360ef27ff602bc3fcbf37e7023fb609de1