Overview
overview
7Static
static
3f1b8c15947...18.exe
windows7-x64
3f1b8c15947...18.exe
windows10-2004-x64
3$SYSDIR/Ak...er.scr
windows7-x64
1$SYSDIR/Ak...er.scr
windows10-2004-x64
1$TEMP/dospop.exe
windows7-x64
7$TEMP/dospop.exe
windows10-2004-x64
7tbu03852/dospop.dll
windows7-x64
6tbu03852/dospop.dll
windows10-2004-x64
6tbu03852/options.html
windows7-x64
1tbu03852/options.html
windows10-2004-x64
1tbu03852/s...g.html
windows7-x64
1tbu03852/s...g.html
windows10-2004-x64
1tbu03852/s...b.html
windows7-x64
1tbu03852/s...b.html
windows10-2004-x64
1tbu03852/tbhelper.dll
windows7-x64
1tbu03852/tbhelper.dll
windows10-2004-x64
1tbu03852/t...091.js
windows7-x64
1tbu03852/t...091.js
windows10-2004-x64
1tbu03852/u...ll.exe
windows7-x64
1tbu03852/u...ll.exe
windows10-2004-x64
1tbu03852/update.exe
windows7-x64
1tbu03852/update.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 19:13
Static task
static1
Behavioral task
behavioral1
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$TEMP/dospop.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/dospop.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
tbu03852/dospop.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tbu03852/dospop.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
tbu03852/options.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
tbu03852/options.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
tbu03852/static_img.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
tbu03852/static_img.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
tbu03852/static_pub.html
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
tbu03852/static_pub.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
tbu03852/tbhelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
tbu03852/tbhelper.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
tbu03852/tbs_include_script_008091.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
tbu03852/tbs_include_script_008091.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
tbu03852/uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
tbu03852/uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
tbu03852/update.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
tbu03852/update.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Uninstall.exe
Resource
win10v2004-20240412-en
General
-
Target
tbu03852/static_pub.html
-
Size
599B
-
MD5
0bf3de7de6f6a9ece7674fb245c7e428
-
SHA1
a71d601820676d5741734e825c7347d59570bc98
-
SHA256
29101ddb9fc880b921c78a8aa0952310ccf0fe4eb03479425500fc2e779d4b2b
-
SHA512
30dc0cf67d772a79dec244882f24c4a6ad71a3139b1b92d6e059f1e677ef138596e71c7bf12c2283b591ad64744b9abd15895fa29c4a600f64c784423bc270b2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 440 msedge.exe 440 msedge.exe 3392 msedge.exe 3392 msedge.exe 1592 identity_helper.exe 1592 identity_helper.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe 3560 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 212 3392 msedge.exe 85 PID 3392 wrote to memory of 212 3392 msedge.exe 85 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 1456 3392 msedge.exe 88 PID 3392 wrote to memory of 440 3392 msedge.exe 89 PID 3392 wrote to memory of 440 3392 msedge.exe 89 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90 PID 3392 wrote to memory of 2912 3392 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\tbu03852\static_pub.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe08146f8,0x7fffe0814708,0x7fffe08147182⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15827398538676915645,8229416689947809117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3560
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD522bb6af63c7710354ac7070e45ac988c
SHA134d29d6b316e39ed8fb8c5efb42c4269040fcf1f
SHA2561a70d5d3dfc04e6f5cfec1ceb06676039229f895f30007fdb55b043ed48ab4fb
SHA51242c12820b5237caa5b4d5149901f84db6619a69e85cb869df06e07b3cad1b51e0c2d0545ee0129cbc8e7947fd8c2989def537ad2d58a1d5bf2c2a1bf60041ca3
-
Filesize
152B
MD562677bdc196e22a7b4c8a595efb130cd
SHA1bd2adf18caf764c8f034c08b6269d9693875f3c8
SHA256b540616d7e73ff22642f4fbe2bea0f9daa2f1166391e76cf817b2a93e0bd41d6
SHA512d23c3b9662eea6a75382242fb8e8084abc1127afbd2632f161df71a2aefaf223621511e1bf6229cf7e86313101a8d9dfe2f20e1c0bd481066e1969cd6fa75e32
-
Filesize
6KB
MD5f28bd04252c4d8dd29d0719443752cf2
SHA121597fe8cfc3d6ec37982cc2f4f103504450d799
SHA2566314a292ef1961f8e8ee67e5d22425dfb34b46f7138f892e73ec30867cdc3326
SHA512a27fd9d406567286dc33956bfc3129ee1c8fc860a72f787165641b01af47fdf749ba93f25d8359a06e16daeaf7d34c6282c48a2ebdacbb85e24fc87ba796c0a3
-
Filesize
6KB
MD5da39db5662544250e460b733a599cc2a
SHA15673621242a6497734aa1e6a7de3093637813625
SHA2561f3e1b36186da59b65b568978a3a119cab540eb9794508fd754b7dbe4e3e4ecd
SHA512a54116fdd0608cb611d4fe60e29166e845d93c04b7170670d8027ce1bf77a6e15136ade7c3a25ab2480f9499e5601ddaf041edafb3d32f3d86c3692226d15fcd
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5f793baf0dae7319e2300a3efd637ab86
SHA1b1f1998cca97f61845ff634a8efc37fe36bbf573
SHA256b8d3060064fa09a457a9e7ca17a5b1195f08373825774adf7dd52b8a185569c2
SHA512c02feb18ef70bfecd9b85511b03c3201b07573239f3ce51751571e87a83e030c53d91c098b778d20c8de57aa0fe5439376a7e006dc82d7a566af1982f85fad1b