797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8

Analysis

max time kernel
33s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

miflash_unlock-en-6.5.224.28/libcef.dll
Size

37.3MB
MD5

0bf35a43180e5f1aadec0767053e397e
SHA1

9211e1ec219b61381eb90c52d6381f86de4484da
SHA256

44361fdbaf429f3f8466f5cfbfd714d2552ecf625fa163ad3d2b57b442413c87
SHA512

88e1571cf13b77d9052b0dd527e3ab3cf1224fe6087c63d3104474655da82460cb9d9e2682d4702af5357d4a0d2305c3fc746211f75a2fc3939ac490ba1b891d
SSDEEP

786432:ST5evSvS89nIV0Wovv09sSFwLxpBVHwsoRePFXo:486vPk0Wo309sSFwLrDwsoRePF4

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	miflash_unlock.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	miflash_unlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	miflash_unlock.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	miflash_unlock.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	miflash_unlock.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	miflash_unlock.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	miflash_unlock.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	miflash_unlock.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
832	miflash_unlock.exe
832	miflash_unlock.exe
4188	msedge.exe
4188	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2840	228	rundll32.exe	80
PID 228 wrote to memory of 2840	228	rundll32.exe	80
PID 228 wrote to memory of 2840	228	rundll32.exe	80
PID 832 wrote to memory of 968	832	miflash_unlock.exe	86
PID 832 wrote to memory of 968	832	miflash_unlock.exe	86
PID 832 wrote to memory of 968	832	miflash_unlock.exe	86
PID 832 wrote to memory of 3660	832	miflash_unlock.exe	88
PID 832 wrote to memory of 3660	832	miflash_unlock.exe	88
PID 832 wrote to memory of 3660	832	miflash_unlock.exe	88
PID 832 wrote to memory of 2300	832	miflash_unlock.exe	89
PID 832 wrote to memory of 2300	832	miflash_unlock.exe	89
PID 2300 wrote to memory of 1528	2300	msedge.exe	90
PID 2300 wrote to memory of 1528	2300	msedge.exe	90
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 836	2300	msedge.exe	91
PID 2300 wrote to memory of 4188	2300	msedge.exe	92
PID 2300 wrote to memory of 4188	2300	msedge.exe	92
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93
PID 2300 wrote to memory of 776	2300	msedge.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\libcef.dll,#1
  2⤵
  - Checks processor information in registry
  PID:2840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\miflash_unlock.exe
"C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\miflash_unlock.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\fastboot.exe
  C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\fastboot.exe devices
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\miflash_unlock.exe
  "C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\miflash_unlock.exe" --type=renderer --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Xiaomi\miflash_unlock\Log\cef.log" --log-severity=warning --user-agent=miNative/1.0 --enable-pinch --device-scale-factor=1 --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="832.0.902435357\356401577" /prefetch:673131151
  2⤵
  - Checks processor information in registry
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ultimateota.d.miui.com/7.6.727.43/miflash_unlock_en_7.6.727.43.zip?t=1705457583&s=18e9fc66abf1be74c4aee8acfa66e41f/7.6.727.43/miflash_unlock_en_7.6.727.43.zip
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9b79c3cb8,0x7ff9b79c3cc8,0x7ff9b79c3cd8
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15281530969394407622,12512760542823239638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ultimateota.d.miui.com/7.6.727.43/miflash_unlock_en_7.6.727.43.zip?t=1705457583&s=18e9fc66abf1be74c4aee8acfa66e41f/7.6.727.43/miflash_unlock_en_7.6.727.43.zip
  2⤵
  PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xa0,0x12c,0x7ff9b79c3cb8,0x7ff9b79c3cc8,0x7ff9b79c3cd8
    3⤵
    PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03d3a202edc3ac6f9c3ee04c1867c8e8

SHA1
c7a6f372ab1fc184223e8bbe9bdf76bb34f0f9d9

SHA256
1240782f7ec92e593f795837543fe2042f7e3f0ed6cf41c6ee722dbc578116ce

SHA512
5501c91cf8377d8ddc147a2919eef485d011f261e5d1cff70484f86c0aff01d79a9f8730b0bcae05af3b7178e9a2bd524f5683dea9991cd769a30be43e1c985c

Download Submit
C:\Users\Admin\AppData\Roaming\Xiaomi\miflash_unlock\Log\cef.log

Filesize
168B

MD5
b68d9054589c5316f494652e129b0102

SHA1
99d6a1fdb79b99794e2d30e10d0c0998c24b9946

SHA256
21267b1911fb49be268bbc22ab92becbde5ba64497ebb2ec9b78d0b9b7da9891

SHA512
e98bef548c8c080b3295db3d8c2ee09b0a44880581fcc4f32134d817390cb06c8a1007dbd18756265d4592189dfe15785cfdde5a44707bf9a447537b5b2c8c90

Download Submit
memory/832-8-0x000000001D300000-0x000000001D301000-memory.dmp

Filesize
4KB

Download
memory/832-9-0x000000002F800000-0x000000002F801000-memory.dmp

Filesize
4KB

Download
memory/832-12-0x0000000006780000-0x0000000006781000-memory.dmp

Filesize
4KB

Download
memory/968-17-0x0000000000400000-0x0000000000A1F000-memory.dmp

Filesize
6.1MB

Download
memory/3660-19-0x000000003EC00000-0x000000003EC01000-memory.dmp

Filesize
4KB

Download