Analysis

  • max time kernel
    89s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 12:39

General

  • Target

    Administrator-DELLXPS1456- 2024-04-03 13-52-24.html.exe

  • Size

    67KB

  • MD5

    ceb9e6829d00ad6e8f25b30d77aba83f

  • SHA1

    865128c3a9baee65deeab14f1fdc9a68969df6f4

  • SHA256

    664582c7357c0ea9f0f6ab524867e1cce887251b11e917ba5c9d81247e57bcb1

  • SHA512

    18703d353319cbd049dfe3d19469eef2ef26615e44101eca43d1c7da515553d2c98e8098e5d2cfbf1c32984d77846dec320223ea4b8189ca9f64d570e7ea0ca2

  • SSDEEP

    1536:j+wPW51r8EHsL71ELMt/RYKiq4vo/1oHHbwr/Ye2WcMX6F8:j+wIiEH+u4/O1HHbwse2SXE8

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Administrator-DELLXPS1456- 2024-04-03 13-52-24.html.exe
    "C:\Users\Admin\AppData\Local\Temp\Administrator-DELLXPS1456- 2024-04-03 13-52-24.html.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN WinTask
      2⤵
        PID:4892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\p.html
        2⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f6846f8,0x7ffa2f684708,0x7ffa2f684718
          3⤵
            PID:2132
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1135385814774750467,6778586384177277015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
            3⤵
              PID:2416
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1135385814774750467,6778586384177277015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4868
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1135385814774750467,6778586384177277015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
              3⤵
                PID:2704
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1135385814774750467,6778586384177277015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                3⤵
                  PID:3672
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1135385814774750467,6778586384177277015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                  3⤵
                    PID:3748
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /query /TN WinTask
                  2⤵
                    PID:1760
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\Admin\AppData\Local\Temp\Administrator-DELLXPS1456- 2024-04-03 13-52-24.html.exe /sc minute /mo 5
                    2⤵
                    • Creates scheduled task(s)
                    PID:768
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                    2⤵
                      PID:3368
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        3⤵
                          PID:2060
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          3⤵
                            PID:2812
                          • C:\Windows\system32\findstr.exe
                            findstr All
                            3⤵
                              PID:1080
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                            2⤵
                              PID:4624
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                3⤵
                                  PID:1332
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show networks mode=bssid
                                  3⤵
                                    PID:2372
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9D36.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9D36.tmp.bat
                                  2⤵
                                    PID:3776
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      3⤵
                                        PID:1788
                                      • C:\Windows\system32\taskkill.exe
                                        TaskKill /F /IM 1116
                                        3⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2692
                                      • C:\Windows\system32\timeout.exe
                                        Timeout /T 2 /Nobreak
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:1080
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4004
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:544
                                      • C:\Windows\system32\NOTEPAD.EXE
                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Lm.txt
                                        1⤵
                                        • Opens file in notepad (likely ransom note)
                                        PID:4744

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\Browsers\Firefox\Bookmarks.txt

                                              Filesize

                                              105B

                                              MD5

                                              2e9d094dda5cdc3ce6519f75943a4ff4

                                              SHA1

                                              5d989b4ac8b699781681fe75ed9ef98191a5096c

                                              SHA256

                                              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                              SHA512

                                              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\System\Process.txt

                                              Filesize

                                              771B

                                              MD5

                                              1a52e5f80dc790047e8c3c1580452c29

                                              SHA1

                                              639b2f686a8e7e98e45c004a4dbd427cb0b19931

                                              SHA256

                                              0ee3ff5e474bc67eabd48da67175f9aa1de5d95dd094c8c0775821c7404b18f0

                                              SHA512

                                              9f93068d4a023953b64c0cf0d1450b200d4e5b2ed76c3febfd686a39b007878ff9474184db9f6c870fad91c809423712ea498a3534cb980a2b377ac00a90b6ba

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\System\Process.txt

                                              Filesize

                                              2KB

                                              MD5

                                              b12f6081b61565a16f08dec9e0fc59b4

                                              SHA1

                                              ac7acaeecf380872a3a0a7348116276d59afb797

                                              SHA256

                                              033799378603c6c0280bf01bbabc09b9e82d6b575b7f7d7dfd0034fb0b969bde

                                              SHA512

                                              9994ac9a4836ed3dd52dae67cecacbe30b5b82f77e2511498ef1ef93bb7f43a95d93dc7bbd28fbeed5792403770211f4446b61ee278489ca3395ea2cbc7925a4

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\System\Process.txt

                                              Filesize

                                              2KB

                                              MD5

                                              eb62ae1e3b4b1bc8b46a94584c0e7d5d

                                              SHA1

                                              30123d4c58ed49ae07adada442f85230a5a8150c

                                              SHA256

                                              0780b51a17e946c2832a5a6c113dfb68c16809c85d36eb8e430a1b73eedeff62

                                              SHA512

                                              203407675339ee4dd5f8418ed473f71ad608d1b05472eada2a96a7267d24902e6c8640e332773e8aba1f13f7757bb6d98c77f337a6edf0ef96cee7ef1772f3b2

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\System\Process.txt

                                              Filesize

                                              4KB

                                              MD5

                                              638a8cc32dd6110d292d332a94108e3c

                                              SHA1

                                              287f656415bd05e79c86261b0a1bbc7afe6d4b1f

                                              SHA256

                                              9095576386a13c18893d33fe53f5914dfdce42936571a6ae9ac94637ec51bd9f

                                              SHA512

                                              565bdd2862f5c25ba4d36fafeee9ef063ffc2a0187d54697e4bcee94a86a8ffd7a0ac295475697898034c4ae1f827c0913ed8ecd7de90a1497523e41024e3f5f

                                            • C:\Users\Admin\AppData\Local\520449c0c259f6311c5b9e56dce23963\Admin@MKDQUQPQ_en-US\System\Process.txt

                                              Filesize

                                              4KB

                                              MD5

                                              33b91f7e3f421755ae190ecf953d6f21

                                              SHA1

                                              061d3218cda3f79c76feabe7dba24ededa2f4786

                                              SHA256

                                              9879dd1b095f02342ceee227119d091c3e42695773c16cb91e78e49ef7ac2a1c

                                              SHA512

                                              f1f0837bcb7e64b8bf9bdf7bd55014b783f579871db1bc2b03f16769d421c18679737e594cffb850ee7061aba9b0596eeaa7fb03c00b3eb36a4368559e89c267

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              0764f5481d3c05f5d391a36463484b49

                                              SHA1

                                              2c96194f04e768ac9d7134bc242808e4d8aeb149

                                              SHA256

                                              cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

                                              SHA512

                                              a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              e494d16e4b331d7fc483b3ae3b2e0973

                                              SHA1

                                              d13ca61b6404902b716f7b02f0070dec7f36edbf

                                              SHA256

                                              a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

                                              SHA512

                                              016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                              Filesize

                                              124KB

                                              MD5

                                              0dc7ff02c8b596847ccd5d535c42e98d

                                              SHA1

                                              daa28d525e4493eab04a601325742a9bbee6849c

                                              SHA256

                                              2fafdbd63a74658d2902f0ecaed35d7f7ad1efc0fcb9dfe090f42f9032b420c4

                                              SHA512

                                              fe2d8e8d8576a8f3791611ff54e636d2f728b6bd0e1ef74b11c66078b62997a17f75630493696b4fd56713a222f141e2fc99e74de9a1d523a2c2e6a8bafbea75

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              63525febbda96135111034d53cb48003

                                              SHA1

                                              9050053dbde5aa4d3cfb78bd9bd838143743d647

                                              SHA256

                                              44ac18c903f1acb30ecd5768c8daffbee44138b4c108b2ce330ef28e122fa3b3

                                              SHA512

                                              2d377d6abd67d47a33bdefc1e3dd6f86a60384761fa5fed3e499c5b27988d290b5a07659ae6ce3ebdc60144dad56d1691af0a1f7cad2ebb88b416586eda50574

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              e7a4eeab0f6fc122b9bc0d7a6f1ea4c7

                                              SHA1

                                              dfb5d6a93d1d890055ac1856691b9de54cc1f47f

                                              SHA256

                                              a6ab2d9684efd589aa56dd369669fc7d0863834950dc8d25765eb21981396ed2

                                              SHA512

                                              d614bf7893fd121db3cdd675aa5897b3b5869e9b9384d8fda17825b37dab94c5f78ab637eb545c56e1fb7077918c5673511f583f9ac56cd2349825700d383905

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              0fe0f6a2ef0c064e21e3f7d8104fc7ad

                                              SHA1

                                              7a24c5c97b5510f265ca330ef9053b44a82223f1

                                              SHA256

                                              8f6c6565b2ba893f7f4e1b54c1ece23fb74f136aba73d241ebda201d08fe2570

                                              SHA512

                                              940e6bdc6aa7f7f7ca8b6115047a6a86a9f491eb656828d86e2ff3ac698403e28e68f20f304dd4bed0ff9517458dd7bcac1a1a2ff556e963f16d03ad5f08ba37

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                              Filesize

                                              264KB

                                              MD5

                                              f50f89a0a91564d0b8a211f8921aa7de

                                              SHA1

                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                              SHA256

                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                              SHA512

                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                            • C:\Users\Admin\AppData\Local\Temp\p.html

                                              Filesize

                                              23KB

                                              MD5

                                              4e4349147d3cbbd440f7f3fac5866fa6

                                              SHA1

                                              563cf45b4395e64993a84665efcb49b3775505b1

                                              SHA256

                                              732efd30bfed7196474ada4a5ffabc01f116bb2b3c68c099991f291ab0c6e325

                                              SHA512

                                              7f2e285507d699b1362babcff71b56e1ddd56fb819a27007f492b2276a10648aef6e5880306a60e2d0265b57b999dfabfae0cb7909a64cf9eebc21f8fcb1a440

                                            • C:\Users\Admin\AppData\Local\Temp\tmp9D36.tmp.bat

                                              Filesize

                                              69B

                                              MD5

                                              aa7a364012eaa1945d912e3dc3165c26

                                              SHA1

                                              2812ab91fd54ff6d378248ac24bd2f9054a25930

                                              SHA256

                                              f3059216b8abc317296d9aaf320f321035ff132da55693aa67bbcc02452afbda

                                              SHA512

                                              bf8fadeeb5d143ae9caa3b53dd14cd2862aaa4fad939f71968b034690feb9ab2fe90b941c0b162491aee6b812b7a6f92e7e6accdcbf79deafd6d2cc862035de8

                                            • memory/1116-1-0x00007FFA35910000-0x00007FFA363D1000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1116-36-0x000001AE57EA0000-0x000001AE57EA6000-memory.dmp

                                              Filesize

                                              24KB

                                            • memory/1116-0-0x000001AE3D940000-0x000001AE3D954000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/1116-2-0x000001AE57EB0000-0x000001AE57EC0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1116-35-0x000001AE584B0000-0x000001AE58516000-memory.dmp

                                              Filesize

                                              408KB

                                            • memory/1116-272-0x000001AE57EB0000-0x000001AE57EC0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1116-273-0x000001AE57EB0000-0x000001AE57EC0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1116-277-0x000001AE58970000-0x000001AE5897A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/1116-278-0x000001AE589A0000-0x000001AE589B2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/1116-34-0x000001AE58230000-0x000001AE58272000-memory.dmp

                                              Filesize

                                              264KB

                                            • memory/1116-340-0x00007FFA35910000-0x00007FFA363D1000-memory.dmp

                                              Filesize

                                              10.8MB