hxxps://github[.]com/PS2ClassicsVault/Call-of-Duty-Black-Ops-3-BOiii-Client/releases/download/v1[.]0/boiii[.]exe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/PS2ClassicsVault/Call-of-Duty-Black-Ops-3-BOiii-Client/releases/download/v1.0/boiii.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 673793.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
2200	msedge.exe
2200	msedge.exe
2728	identity_helper.exe
2728	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 728	2200	msedge.exe	83
PID 2200 wrote to memory of 728	2200	msedge.exe	83
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 4876	2200	msedge.exe	84
PID 2200 wrote to memory of 1560	2200	msedge.exe	85
PID 2200 wrote to memory of 1560	2200	msedge.exe	85
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86
PID 2200 wrote to memory of 3120	2200	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/PS2ClassicsVault/Call-of-Duty-Black-Ops-3-BOiii-Client/releases/download/v1.0/boiii.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,14516015907882561143,15332678206309793912,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d60ed3d58d15f5f28ad89c5d81b59b5

SHA1
495298bab9d339650f21ad448d00ce5b42f67e70

SHA256
c341a386bfd4dff2b10bb9fd64d8d6e482c083bb08fe40822cdac927910b49b2

SHA512
cfa897356909cde3c176c9e9c1c470a27814ac153162c3c2c6eefaf6e2d07b4429a91ea1e1a799517d4069ecbbd1050cd6adf40737ef19eb8fdf4677e9980a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b37d3f83dc581c246eb2bdffdb9d376b

SHA1
a2a3a64e8cc3e9ccf279744848b97b34f0d85518

SHA256
a434a1d344dfc1d4df1ddb0f601a31bedef456bc3eb3c8c3de1a57f12889f8cb

SHA512
3845aa0521f348d3417fa9e8a9a7e1aee7d4a8585705627ee31dcc6677d3e77978e09d761de181fc485cad0d24a9336098edf39c33ca28ce0df15dc15a4347b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c93cb3d86451b9db5e2106d398e5f7a

SHA1
0d1f02f20a41d25010bc728fd91a89bde1455328

SHA256
b3d3030d5478c346a957c6d61b352f068f2733d90ef9de1e882bee3e5f5f8254

SHA512
15ff7e0f0479714e701981a4bca32643343f40a9f5f14022d23d8fd759b87e44686a98607dd470726815fff63f63ff905fbe0a0fbd1234704ce71fa52b8e2df7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 673793.crdownload

Filesize
2.5MB

MD5
2cc3292db6248bf722c10820b0440386

SHA1
97368ba537202268ea45e41d4b1ca7b2f759b76a

SHA256
ea45a595246d04c975da85787772cdaeb46b957b4bf138d52a876e1e6428dd87

SHA512
29184e2e0f564d19f846c467d9235f68807a4e17dc9ac9d4fcfd444bc5af17247e0629543733e26f5a16bf91c3e43139facef6595d94c1cdc484a042baaf6318

Download Submit