hxxp://www[.]zbjinliwang[.]com/

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://www.zbjinliwang.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
3908	msedge.exe
3908	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4984	3908	msedge.exe	89
PID 3908 wrote to memory of 4984	3908	msedge.exe	89
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 1604	3908	msedge.exe	90
PID 3908 wrote to memory of 4960	3908	msedge.exe	91
PID 3908 wrote to memory of 4960	3908	msedge.exe	91
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92
PID 3908 wrote to memory of 1448	3908	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.zbjinliwang.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffcdbe946f8,0x7ffcdbe94708,0x7ffcdbe94718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4559382701700843449,15472691076105879265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e5c8b1023ff7a0149478c23052a21eb8

SHA1
3561defc5003091b0d1a0e323aa023a73913c55b

SHA256
7341a6f4544876b5ec4b0cf383c71b8e90acbc839a8b26157d18a0e27fcb9829

SHA512
9f09727192ca2ccd9343428cd1fbdd3514567b972aa9c4823ea2b22e968dc389cb0ab0538f4487a91ac66aa954d5066670a90c5be7aba2be0339aae978f5ab21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5dcc259cb9901920266509d231219005

SHA1
77a6e3a4f35409d94a5d66b419c2bf90403452fe

SHA256
7c0f2e6436a8f18db64d4aef71356ce81ed0878ff52392c5fda0c731d859e78e

SHA512
da4a0deda0dbd2f3dd191d80b88a643bb3cfea6fb8b875fcb2d71403c73fdc731ab60fd73b81e0749b49cefd1a8095ff7c54319d6e69bfb8ec954b2bbfd45477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bac62117119534a17d302ec3bccf109

SHA1
6d09ad2dcc3e49786c6cf732598bc96a45d76c39

SHA256
ffdf5b48734111381fddb6706b822451e92b2d93a877211d819167cc9599c983

SHA512
66da594fe4599cd601701122d08cfefc348acf356d67d27c1f0e280eb1ffdaef944073e13779b1e10dec63089554910aa8635f52695cd416c3fb1f6428428c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0600fc0c6713b3a9b6a52bf379f860e1

SHA1
e92f17d096d4580326494742bb70b06ff11edd71

SHA256
534f90e412b75621ea3bafc12cd96e15640a875106cff15311bcdd7dbf87da47

SHA512
97f9fb4711e49b616e8fa50c0369f673956e6ff92818633ae61ccffc4b2ec6363ee3ba7c4f587727a3b12a6c868f9f76fb5df1bf51ecc28f75fd139271300fee

Download Submit