hxxps://github[.]com/erfan4lx/Windows-Virus/blob/master/svchost[.]exe

Resubmissions

10/05/2024, 14:50

240510-r7kwqaee72 1

10/05/2024, 14:44

240510-r4cqyaec98 1

10/05/2024, 14:40

240510-r166daec25 8

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
10/05/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/erfan4lx/Windows-Virus/blob/master/svchost.exe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
5104	msedge.exe
5104	msedge.exe
1580	msedge.exe
1580	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 5036	5104	msedge.exe	80
PID 5104 wrote to memory of 5036	5104	msedge.exe	80
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4256	5104	msedge.exe	81
PID 5104 wrote to memory of 4892	5104	msedge.exe	82
PID 5104 wrote to memory of 4892	5104	msedge.exe	82
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83
PID 5104 wrote to memory of 4984	5104	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/erfan4lx/Windows-Virus/blob/master/svchost.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9dab03cb8,0x7ff9dab03cc8,0x7ff9dab03cd8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1708,2266843115012719387,8495084839891135427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f1afccbdb60ba1ed387c248917532278

SHA1
a77bb23a7fecd25438fe43a49fca1e4eff047ad2

SHA256
c1880963e71c2839cf96e7be93ac1dbbe0a8ffd327ef809173a2ad5c1411519e

SHA512
e83473b4334b8d6a8182f4b6291f2c798123cd75561b56682edb76932ce9e32df57ab08be1901b85caebc7961c3d8dd5e1ed19a327de589c0b6d39ac1c4da0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8ac154a3d3ea2f63eb5dfc610482039

SHA1
21070fc5149e6831d7e8fbb9c162ad3b6c481814

SHA256
fa5c15c8c0328574abd2db19b193a1b103d8caea97f53e649a0d8a28569061d7

SHA512
9863b85d5a2250838a3484b2223bc23312d5d59a473a492177717a6a2c252a9d4ac10b86cc5b782c9bb178c68c52cc257db4d703338d47858dc732985be188f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e4a20a01d3b4f33a718ef9d02ba37e1

SHA1
74beb5a96ce69136e5912526346fffba6d837add

SHA256
9fee21831f610ddc7a54cdfbcfb9821fc33f68ed3ca48592e6c6c36fdbe73313

SHA512
af234b84722c81601525afbaa8edc941b53121253d9dd092a1a58f8719f0ab801af7db6c5a14af5017d090ffd2c492a7ded5d226b3bc31c74111f4c9d9ec3a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1716ab781627df5f9a682d79bd6e2e6

SHA1
87bd1a0741787ca3de28ec8018370f93b09a3c9f

SHA256
c38c9d95575af149f9e3cc5fd581a5fa36c271b1478b50ed2c491d50eca0ce52

SHA512
f68863e83f3ad5ae5a792e32366d7faec8073b83574de2a84bfd8e0deaf2c5c7c540397df260d26c976c5f26ab6f7cc5458ad413d99e3ca52303e403c7388720

Download Submit