Overview
overview
7Static
static
3f1b8c15947...18.exe
windows7-x64
3f1b8c15947...18.exe
windows10-2004-x64
3$SYSDIR/Ak...er.scr
windows7-x64
1$SYSDIR/Ak...er.scr
windows10-2004-x64
1$TEMP/dospop.exe
windows7-x64
7$TEMP/dospop.exe
windows10-2004-x64
7tbu03852/dospop.dll
windows7-x64
6tbu03852/dospop.dll
windows10-2004-x64
6tbu03852/options.html
windows7-x64
1tbu03852/options.html
windows10-2004-x64
1tbu03852/s...g.html
windows7-x64
1tbu03852/s...g.html
windows10-2004-x64
1tbu03852/s...b.html
windows7-x64
1tbu03852/s...b.html
windows10-2004-x64
1tbu03852/tbhelper.dll
windows7-x64
1tbu03852/tbhelper.dll
windows10-2004-x64
1tbu03852/t...091.js
windows7-x64
1tbu03852/t...091.js
windows10-2004-x64
1tbu03852/u...ll.exe
windows7-x64
1tbu03852/u...ll.exe
windows10-2004-x64
1tbu03852/update.exe
windows7-x64
1tbu03852/update.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7Analysis
-
max time kernel
146s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 19:13
Static task
static1
Behavioral task
behavioral1
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$TEMP/dospop.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/dospop.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
tbu03852/dospop.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tbu03852/dospop.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
tbu03852/options.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
tbu03852/options.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
tbu03852/static_img.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
tbu03852/static_img.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
tbu03852/static_pub.html
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
tbu03852/static_pub.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
tbu03852/tbhelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
tbu03852/tbhelper.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
tbu03852/tbs_include_script_008091.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
tbu03852/tbs_include_script_008091.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
tbu03852/uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
tbu03852/uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
tbu03852/update.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
tbu03852/update.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Uninstall.exe
Resource
win10v2004-20240412-en
General
-
Target
tbu03852/static_img.html
-
Size
503B
-
MD5
2caff3519f5be538757c467d4fec4756
-
SHA1
7e77344f049d9ee4d216b6f412c01ba28596773c
-
SHA256
e94503ad0ea2a4f7002ba70f57e12da9daabb5037b6bedc7725d1fc43a487415
-
SHA512
029814dd117053d03acc6c0cb1af2802256149c6a3588cd41334deeffad6095dc16386887e2053f288b13a5ebd3599cbf9c55c194fde81f3df77045d2609a467
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 808 msedge.exe 808 msedge.exe 1772 msedge.exe 1772 msedge.exe 936 identity_helper.exe 936 identity_helper.exe 1528 msedge.exe 1528 msedge.exe 1528 msedge.exe 1528 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1972 1772 msedge.exe 82 PID 1772 wrote to memory of 1972 1772 msedge.exe 82 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 436 1772 msedge.exe 85 PID 1772 wrote to memory of 808 1772 msedge.exe 86 PID 1772 wrote to memory of 808 1772 msedge.exe 86 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87 PID 1772 wrote to memory of 828 1772 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\tbu03852\static_img.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86b8446f8,0x7ff86b844708,0x7ff86b8447182⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12549445758158113458,12242938521262696084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2740
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e2ece0fcb9f6256efba522462a9a9288
SHA1ccc599f64d30e15833b45c7e52924d4bd2f54acb
SHA2560eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005
SHA512ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac
-
Filesize
152B
MD5864aa9768ef47143c455b31fd314d660
SHA109d879e0e77698f28b435ed0e7d8e166e28fafa2
SHA2563118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10
SHA51275dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488
-
Filesize
6KB
MD53bf86bd535bf0456403f55395f0a6dfd
SHA1f258367a6c992f9d504b9672be683a1c493022a8
SHA2567d5c1d372d37cc3d0f31188174a73deedaba11e1a62bba59a12f3117503545a3
SHA5128f50a96508ee6b4811743c6abce8a38c298f5452439edeede7e863322048277d6f2f6021084a0dbd9e101ad5a3035fd9df982826b68866e334640bda4e92b28d
-
Filesize
6KB
MD538727a647912d751f1ed9575bec7f029
SHA13d7fde7ac15fb382f6206e0c314da11029cd18df
SHA256b7b18fc29328720e51ecc0adb3764b93844e2a44119562cdcf1ddbb966175e82
SHA5122540d67e7ec8a3ad495ed5f0d16f48a0be4c7335f8c690837c625017745520f16e5a42e1feee1dbd680c7b3603248df3ce6db40b1b2ecf9643960a4a062f3b83
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD51d747f8c9fc8d16257744be2f4172367
SHA14634acbed460412c09b28d4f78394c0d56399449
SHA256957b95705de1cdb311cc4ffb63fb020561e18c3b7195cb90533b0a2f97ad6ae0
SHA5127671ca2c1faceada73f604fe75ea7e28e017e5499b505477bf70d0d7b8297cf0807a35e578f97b59748172b8b9a1f132f1bb5dc42db6d181fda3338411bf0c21