d13eff050e1694937e1a540bd1126110a80da9b5561f530545d1d78227922f38

Analysis

max time kernel
133s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
26/04/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anis Posted free.exe
Size

708KB
MD5

00058545d21d4fd66d00344af88e8c7f
SHA1

2f42994de870e7355bd435eb2dfd4d89a0d5ce7f
SHA256

d13eff050e1694937e1a540bd1126110a80da9b5561f530545d1d78227922f38
SHA512

97c69c0e86afca643d4d7462633f7e8bebea88c4a5aef1233cf2c9de5de4fe219dad9c9e1dd4da611f866f2431113197b761c37f2de8b01cefdc9d31160ec132
SSDEEP

12288:ejDhtRUtasxN4xpFrBKiLnKIFMdym2jO+Aem8cLP6uUt+gPoZn:ejtQNj4xvrUiLnKIALP6X+6oZn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
420	msedge.exe
420	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2236	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2236	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3996	2244	Anis Posted free.exe	80
PID 2244 wrote to memory of 3996	2244	Anis Posted free.exe	80
PID 420 wrote to memory of 1548	420	msedge.exe	86
PID 420 wrote to memory of 1548	420	msedge.exe	86
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 3764	420	msedge.exe	87
PID 420 wrote to memory of 2712	420	msedge.exe	88
PID 420 wrote to memory of 2712	420	msedge.exe	88
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89
PID 420 wrote to memory of 4260	420	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\Anis Posted free.exe
"C:\Users\Admin\AppData\Local\Temp\Anis Posted free.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff97c703cb8,0x7ff97c703cc8,0x7ff97c703cd8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7939952295593939584,16779747435068039164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9faad3e004614b187287bed750e56acc

SHA1
eeea3627a208df5a8cf627b0d39561167d272ac5

SHA256
64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9

SHA512
a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7915c5c12c884cc2fa03af40f3d2e49d

SHA1
d48085f85761cde9c287b0b70a918c7ce8008629

SHA256
e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da

SHA512
4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d9f3b8107a3375140917c5f079f733e

SHA1
6e20767f9f6f6410c4e4149e61a57def46f11a4c

SHA256
c458ecdebc51d6ad7e36ce451ed10cf460124a911f78366101cf17221c767c00

SHA512
83e90b05f0f193c4f9e5b526d1889a9c3790ffa138266e799edd7b48a002d46538ce50d453a4659069ba728027787eda0f43c1337882ed5ddb63b55f7cb9206b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d11cd24bcfc6d5a4e1f30f73e87b857f

SHA1
88a83b97208d82fb918b8a0b170db11da208ed1e

SHA256
f9020f862cdbeb40ee06194836989546b16a3e6eb00591ac8a71d18bd4de6b54

SHA512
2e07055ddf28f3305b5b76113f7643ef6854cc976798996f02ba284e41aad93db6a194da5f5ebe2aede5f9b7d094e571574b7017db9db397c9c7a9b49e1eef3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30d63d2920506a99e76a7ef8b8917511

SHA1
e8117acdc44e46deaa5e512b32225e05175cfa90

SHA256
295302b9871a2604b4407e3015ef845797d27fef8d1083c70a171d1c358605bb

SHA512
64ea91bce5c543c7778d1c049ce362c3cda9f5ccc2efbc54f9a6da08f6fbf6eb0e4400ab49b31d68eeaa0e2ec71ff785460a58f59e3a52aedcbde172eb439da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2591b41297725040fce37e116776d06a

SHA1
febac13a156fc282f0bcb6fdf4f8925fc7e9521c

SHA256
87a965a5ff896faf31dd55e9c5db39be6a59a72651b88fae5fc552083e065b03

SHA512
eaa9c99f49b0b40b8167480b5117cbb84dc8d0d307e58d24da26e5b9ddfc4e4f6b07e4917608fe85b17fb18e200be9a22725eb29ac94d2024cbee169d7881de1

Download Submit