Overview
overview
8Static
static
3IDM/!)ж.bat
windows7-x64
8IDM/!)ж.bat
windows10-2004-x64
8IDM/!)̻.bat
windows7-x64
8IDM/!)̻.bat
windows10-2004-x64
8background.js
windows7-x64
1background.js
windows10-2004-x64
1captured.html
windows7-x64
1captured.html
windows10-2004-x64
1captured.js
windows7-x64
1captured.js
windows10-2004-x64
1content.js
windows7-x64
1content.js
windows10-2004-x64
1document.js
windows7-x64
1document.js
windows10-2004-x64
1welcome.html
windows7-x64
1welcome.html
windows10-2004-x64
1welcome.js
windows7-x64
1welcome.js
windows10-2004-x64
1IDM/IDMFType64.dll
windows7-x64
1IDM/IDMFType64.dll
windows10-2004-x64
1background.js
windows7-x64
1background.js
windows10-2004-x64
1captured.html
windows7-x64
1captured.html
windows10-2004-x64
1captured.js
windows7-x64
1captured.js
windows10-2004-x64
1content.js
windows7-x64
1content.js
windows10-2004-x64
1document.js
windows7-x64
1document.js
windows10-2004-x64
1welcome.html
windows7-x64
1welcome.html
windows10-2004-x64
1Analysis
-
max time kernel
158s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
IDM/!)ж.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IDM/!)ж.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
IDM/!)̻.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
IDM/!)̻.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
background.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
background.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
captured.html
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
captured.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
captured.js
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
captured.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
content.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
content.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
document.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
document.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
welcome.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
welcome.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
welcome.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
welcome.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
IDM/IDMFType64.dll
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
IDM/IDMFType64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
background.js
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
background.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
captured.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
captured.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
captured.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
captured.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
content.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
content.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
document.js
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
document.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
welcome.html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
welcome.html
Resource
win10v2004-20240226-en
General
-
Target
welcome.html
-
Size
3KB
-
MD5
dfcfd01cd1323e88e3c96c5249193f0e
-
SHA1
7d9969970846c9831d4e158c75db86b56fdb1c89
-
SHA256
871857877cf47972d457bd74ccab05da31cc58c9eb0471a6e15b97b7d68b8a25
-
SHA512
cc101c59af5251287c8597db89dbbb90c5323d247bbd4d76b88c2219804d0a77edc180193ac0a13fe9de8a601a1855fccf03cb2b055a6ac902307cf59386c5ad
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2544 msedge.exe 2544 msedge.exe 232 msedge.exe 232 msedge.exe 4528 identity_helper.exe 4528 identity_helper.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 5084 232 msedge.exe 87 PID 232 wrote to memory of 5084 232 msedge.exe 87 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 5004 232 msedge.exe 88 PID 232 wrote to memory of 2544 232 msedge.exe 89 PID 232 wrote to memory of 2544 232 msedge.exe 89 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90 PID 232 wrote to memory of 3260 232 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\welcome.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4b4a46f8,0x7ffd4b4a4708,0x7ffd4b4a47182⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13169535813787058189,1919122879446591325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536bb45cb1262fcfcab1e3e7960784eaa
SHA1ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA2567c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA51202c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
-
Filesize
152B
MD51e3dc6a82a2cb341f7c9feeaf53f466f
SHA1915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA5120a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2379de0d-7583-4540-8265-647099229e76.tmp
Filesize111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5e3dce13788651d990a40600335080ca3
SHA1f42d8f66c6f01b7029bac5d96dce318ad40c64cb
SHA2569d99579f515fff8e8cad8a301da2ee653a8d2ef36f633acb079953ca7dd3a803
SHA512ef63a61a0aa5798558e2bedbbf9f44d81f48f0001fc703d76a0727ccd5575fcfe14cb3ed7d814b463b0575906a2774e88ce26e7f7eb164b9f6e46a23321abbdf
-
Filesize
6KB
MD57bb2a04021b4748eab8f727d2005a7d9
SHA135ee6c8b2cce463a24456d29856a4520d1e7d07d
SHA2566d22818ff9b5a8e3dff3e149fbe11b889846d4cdc9ec09a9eb7fdffbd9d6ee85
SHA512d8f620fb11ae70fe4f905d098f2acfaeeb027684a9ec303107689c15a8c25112f529964799d200cb350385efc39370747691e6fd776cf0f4b80bc1bd7a9e81a5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f73e9fea796d05e49a07695128d9b47c
SHA11391e06492f4e1ba8125c9b3183269a8699deab0
SHA256a1669593d1f568750e88845ebb70648f76e229eb60ac0f2497097a73a8307dbc
SHA512be41581e902b18e9a46a2ab1a4ca0a74ca1965c644b480cf4a885634dffee0f9fd9b20f6f9def0fd078935c107272caba58c2f8f84663978e1d2636d4b3166ba