Resubmissions
09/05/2024, 00:31
240509-at4y1agc8x 809/05/2024, 00:30
240509-atn8jsgc7v 109/05/2024, 00:29
240509-as6q7sgc4t 109/05/2024, 00:26
240509-arpfjagb6v 8Analysis
-
max time kernel
1175s -
max time network
1176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 00:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/pankoza2-pl/salinewin.exe-Malware
Resource
win10v2004-20240426-en
General
-
Target
https://github.com/pankoza2-pl/salinewin.exe-Malware
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2864 msedge.exe 2864 msedge.exe 3392 msedge.exe 3392 msedge.exe 2160 identity_helper.exe 2160 identity_helper.exe 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe 6004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 4908 3392 msedge.exe 82 PID 3392 wrote to memory of 4908 3392 msedge.exe 82 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2992 3392 msedge.exe 83 PID 3392 wrote to memory of 2864 3392 msedge.exe 84 PID 3392 wrote to memory of 2864 3392 msedge.exe 84 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85 PID 3392 wrote to memory of 644 3392 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab54046f8,0x7ffab5404708,0x7ffab54047182⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:5412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10793315796917544764,8227619385059395464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6004
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3836
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD573501775e0903853e9f7c57d692b84cf
SHA1f7a14b1a3f8673a69111010c1c0209b0a7b768d5
SHA256eb6e4b1a837853d258b6157521011d9746924a94fb0af54c791b96948096b730
SHA512dc004b2a5ddc02a8261f0448be25521e06347d3d249e2482bde488dbd4ada289ad1f4905663e3f97b5dd676bdc890213db59bc181ba4bfa7c23674c0767ab685
-
Filesize
496B
MD5cd8c5cd6626e41fe9af55b28543a4734
SHA10af4aba7faf1ff90cc5ed35948b7b24a3865beef
SHA2569272831209de3e32bd12cbf5ed52f8fc6de56d8e5ed424b1d9e442d0fa3fac1e
SHA512bbaae4ae8fb9d035e02477f7bb1f8cf10103ae6449612288c97d2fca0050583d336dd5e962183017f7d37cc3157d44cdecafac0d5bcef5660d8bf7a5bb4d5a87
-
Filesize
5KB
MD563831d7da3970266c7b9577063ba0489
SHA1741cf47a2c00bab333b0f2a18ff96639479652d9
SHA2565fac45b2ec67bb5f04b7098a0a7cf70f80c981067fc94e25b8188bca66043296
SHA512ae109ccba3091669276e823bdc2ba18c5a82ed475b4912ee5d6ab504eca2b23ef01074f44d7943baaacae4a75f4d14bbaa38817a4ba43f5d815bcaa70184fad2
-
Filesize
6KB
MD55aabd617d5a4d4523630a315c234ab1f
SHA12d48c49f9b48cd623fe4a2036d227acbc50564e4
SHA25663b3652c7fbfd5b0d6e1fefe2e6184cea82ada78c05fcdc05668bbfc63c900e7
SHA51261c835994a7c2d225ffdd609c2bd5024b3dda0b6d038ca132379a60fbafc8101b839a14237dc4691243dcb6cb4445db1e2d0311224896bfa3444be580b34816a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b7d90ad960fd11397226534e982073ee
SHA18491b0e510058f6cf82466659f6cacf0d7609ba9
SHA25650285244d634c1aff6a97a79244efc841e6ecaf39da6af62f9f540281132c671
SHA512639455aabf76a8abf62264eb5714299c137d0bded72329c37ce8dddd79b339d7381694ba0dffe834ab3073e6a858d2493179bdc6fd1252029455528ad95756e5