Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
Payload/aisiweb.app/TencentOpenApi_IOS_Bundle.bundle/local.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Payload/aisiweb.app/TencentOpenApi_IOS_Bundle.bundle/local.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Payload/aisiweb.app/aisiweb
Resource
macos-20240214-en
General
-
Target
Payload/aisiweb.app/TencentOpenApi_IOS_Bundle.bundle/local.html
-
Size
4KB
-
MD5
eb178a536d50a25f51c77eb780fa36ca
-
SHA1
5d06cbc455fec0f591f6994e9f8e75c501e6e180
-
SHA256
9f90d886d5750e7bcbaa148f9b9b3c04c3ba924cdf7962f37d97a5fb1cb59272
-
SHA512
4afad9921f32ae28e048fa80c59e0ccb1ededd94f213aa8d94d268bfd749e753dbffc03f02413ddaca86ba2470411648c8839e41b13276df74d51681bbc62ef5
-
SSDEEP
96:YDNWFcZTmEFJmCtu3hN0a4BkrvLG13GjiiipDJLu67c:L4mCEhO3B4Eai5/c
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 2164 msedge.exe 2164 msedge.exe 408 msedge.exe 408 msedge.exe 408 msedge.exe 408 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3588 2164 msedge.exe 89 PID 2164 wrote to memory of 3588 2164 msedge.exe 89 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 676 2164 msedge.exe 93 PID 2164 wrote to memory of 3984 2164 msedge.exe 94 PID 2164 wrote to memory of 3984 2164 msedge.exe 94 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95 PID 2164 wrote to memory of 1532 2164 msedge.exe 95
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Payload\aisiweb.app\TencentOpenApi_IOS_Bundle.bundle\local.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc82f246f8,0x7ffc82f24708,0x7ffc82f247182⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:12⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11696508822353518284,5158473801664589830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2592 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:408
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4628
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD553fcc58a2129a316a818ca41985daf4c
SHA13e5819207f9120ef4f00a9d223afff0bdcca4dd0
SHA25601e8b04f88c0a0f14e440aafbddb41f93ca797946e15726badc338fda5051d29
SHA512c240432ff2542456b5aa767ea6692eae1f7acdb13e466b638282122bd8cf428ebc2437c64c3aac96dddf6d5dcd2063297d08017468156b8964bfe31181cb85fd
-
Filesize
6KB
MD50572d54eea44a3604ede4ae0e221f8ec
SHA18885f99309cb5ca5e3e1c2c4c61802ddf9375b51
SHA2561be593f92d1dd20d02b1542cf4e1a64026d33abb08aee0df9245fd72f6e901b2
SHA5125b00db9b1ae53d219d9706924cbdd3b8f5d0979fb508694614c35780a01043d2d4801fbd9dfef2ce78a8100c9f367063bd5c1882bf39aad8b7e04d367bcecde1
-
Filesize
11KB
MD567ec0d347d7a0b3c8fc5c802a21691fc
SHA1b932d11acc4d0b3c3ba1e9be63cef9a4a68ac11a
SHA2563fc27efd73533b73dbced5de834c388045dc3eff1dcb55e007fe9c41c218cb7e
SHA5121bb631aa060f2db71bf8ae454c10391a465538e41ec5d64aaebb3ef5669be9f5e47efd396ceb0503eae7f03514cfe5152b7ce215c9e9a1d72f7e13ce49b579cf