1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46

General

Target
1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
Size 896KB
Sample240512-bec3eaca24
SHA256 1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46
MD5 c2df5090d75c363adb48d96da9b40e4d
SHA1 23ebe2aedca6e1cb79ff27bb3ab91ce87374aad1
SHA512 4ee0c93e062f1797f814c2eaa19829eb467dda57f70e5fa3aa03ebdf56f4b2afddabab7342f3345b22ad030d629c9b736ce2c90d0c401f6e6b6a7299b592bc42
SSDEEP 12288:jqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga0T5:jqDEvCTbMWu7rQYlBQcBiT6rprG8aU5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{4FB809C4-EDAC-464D-A574-FCB1CD3D582D}	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 864	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	89
PID 1980 wrote to memory of 864	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	89
PID 1980 wrote to memory of 2996	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	91
PID 1980 wrote to memory of 2996	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	91
PID 1980 wrote to memory of 1956	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	93
PID 1980 wrote to memory of 1956	1980	1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe	93

C:\Users\Admin\AppData\Local\Temp\1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe
"C:\Users\Admin\AppData\Local\Temp\1650380cbd9eba0935643a02d7122aa2f7c8d1120edc4a6d3c73fb2b0ddf3f46.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4224,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
1⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4584,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:1
1⤵
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=3828,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5408,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
1⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5428,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
1⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5424,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5736,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
1⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6440,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6564,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6568,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
1⤵
- Modifies registry class
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6788,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
1⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=6428,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads