hxxps://sourceforge[.]net/projects/networkminer/files/latest/download

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sourceforge.net/projects/networkminer/files/latest/download

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
2552	msedge.exe
2552	msedge.exe
3308	identity_helper.exe
3308	identity_helper.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4444	2552	msedge.exe	83
PID 2552 wrote to memory of 4444	2552	msedge.exe	83
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4716	2552	msedge.exe	84
PID 2552 wrote to memory of 4168	2552	msedge.exe	85
PID 2552 wrote to memory of 4168	2552	msedge.exe	85
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86
PID 2552 wrote to memory of 4648	2552	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/networkminer/files/latest/download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4f946f8,0x7ff9a4f94708,0x7ff9a4f94718
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18129913097353128287,2513487866073286282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
b167e60640860b86a688ad1ec064ec34

SHA1
f339466473764515eb6e16461f110fda59ca7ba7

SHA256
c93d74cb6e1c514250ffd95a89306052dda3f781156c87a71a57eebfe10854d0

SHA512
9a662f3607bb351031dc798585e05a080ce597e8ab2b294b01aec030dde1f03797379e258518854d73e272c216dee96ea2ff2b4b7679e8793ba58d437a671be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
401B

MD5
72472bd29a48c3fd6baaf3032e644bcd

SHA1
8d8d3427429ccf65ad23e79811ff6ed602faaa36

SHA256
3854b804facc975b88d8798524c29c027642d5be8897ace2dd1ee3a562844be0

SHA512
30d947ced40d3cec67614adfbe047b1208b577eb234d26459368ca41af55625ddc6f9fd492b5c76409b4a2a46a5d4faa20ff1814e803b9bf0d4c4e71dad72dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ed7e6095be5b6b45dcb9491c1fb6e37

SHA1
009fe20eed44f240efb5966604f25665ae64f129

SHA256
a463ef97cabfcd19581686b4998c8ff91ba4fd74d39ef00e52ff8d301fddef14

SHA512
85930407ede7c210a785e255298fd8e537db015cb2794c18e9ad2b23541dbcf08f8dff080518c9238f115552ec148fc60d4954a2c81633621dbef886cdd48fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
783bcbdb39a64e700a65b1349d18a8b8

SHA1
736215bf2172606295dffb21e7dc4225e2102ab4

SHA256
5a68af3d750e2f7d85ae4a1ea6c43a53a23a45bb2545e2db97cfbd669a6e9a49

SHA512
a37205cd8ccaaf7d90fc6c5f4a8f306c13b6c8052203b101afe15706d65f76f89f2a11428d73cd2b293baf1aef6b5bb78645570f0f4c70ea5d6db39adc926713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b62c50822a105e7dc984e3f4458d9f5

SHA1
67a65259c1902e8e72225f5d83489ac6bf5330aa

SHA256
e51afad24d97154b411cb080f032a455ba8e46ed32b92c7d2ac2f4ebc3dc78d8

SHA512
db654295024a04109a6056b140826c8ad5ce29a89beedce519f93336bbf716b79ce0ca83d4d2fe3a3185faed8d7f2c85ef707088b7fbeacf329a7e47aef29a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6022b4da6fb871232d947e3a4c3067a

SHA1
da2105397249310cfa8670744ba4208363e92e2b

SHA256
64b67abd82d397613f458f05122aa10c63d4400b1110e6b56e4fc472693c7c27

SHA512
4fd4bae4b413812d08d4479079fefd795a79653f293b0a9c0fda79a7440818ec739a1b505163db0e7123d0b0cd7cd913d48b712cea8f77b3bd117144746ea527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91e5ccfb23d9453395cd698998885bdf

SHA1
3555c368245b7a30c572f056255007ca7e94b692

SHA256
63767256a104241956d38f7b03daa5853c3ec7b8137ac1b450f89bf1c4f99265

SHA512
ffed6c9a9ac63de5255458fff351a0aa17c3eb6351b408c731416819cf6e3f2b2ee34a4a5ce51a36c816c3a18aeadaffe4f1340bba1fc2b90f04bf00baa266cc

Download Submit