hxxps://calcplex[.]com/downloads/

Resubmissions

21/05/2024, 01:30

240521-bwt29adg86 1

21/05/2024, 01:28

240521-bvyn2sdg65 1

Analysis

max time kernel
1770s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://calcplex.com/downloads/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
940	msedge.exe
940	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1624	940	msedge.exe	82
PID 940 wrote to memory of 1624	940	msedge.exe	82
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 392	940	msedge.exe	83
PID 940 wrote to memory of 2192	940	msedge.exe	84
PID 940 wrote to memory of 2192	940	msedge.exe	84
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85
PID 940 wrote to memory of 1176	940	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://calcplex.com/downloads/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ff8f93d46f8,0x7ff8f93d4708,0x7ff8f93d4718
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,154188967821039245,7545390337664791352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
5c12599810c490824021c69390476d3e

SHA1
da84e6f18b639d219546baec194220c2f5313b1f

SHA256
8f69161dae3ad14b3af80d8ace369795b1266570e12ebdcdf3e5fbdd404c6108

SHA512
76b2e041c7e89355fabc969701a15344dacd3d4228bad065d09e4af54cab825980c705629699cbf5d36a21c4cc62a34a4d571db90d96bbb4ba26c55c42573717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
23d2e0a73e2da3d61cf22b2d36836793

SHA1
9979fe7dd9864b77055396786c6235d6da54d520

SHA256
b2a2ea1570bd3b64f7f157b143096cf29ddcfc0e737a24b49314fd69995c0ccb

SHA512
57e9f99fa939257b63632eeb32bc4e85ca3e61dab875522d5b628e30d320bbd6f29997c898d832986929e0d3e37bc4e7d129d92bd8afedf933d8b50efa5fd289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
920B

MD5
5ab5aeddf6ee85c30cdc3eb9770147bd

SHA1
38f6b47d9d7e3ead4894417a65b6656117c98e6e

SHA256
2d30140e5d4def0b3bf13be3da9c8cc5c5f4ebe576bd48230383bb95f462034a

SHA512
a293f46fb5fbef770025ef8631b2db793f09c425a7afe7562f5bf7e9293b342dc1a94255066719fa12dcd9d7e5833b0eb6a40115ca82eec1f81c193703b5c3d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8875b876cf11a28bff62423369e53d0b

SHA1
dfc5feb3dd0c8f1f51d3826bb753d209e97aaed3

SHA256
22e1d97211a1ab21243ed06530ceb2bbfa547e975124e69415b9e9a5bb5e6584

SHA512
6633deaef89d3c88e3457010ebae348e3ae3bf1fe04e43628691a68aca277ffd331e63b0098f948f9e3c847dcf06ca5b2e5113024a75dd6ba395fb52b9983156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f835e4cc96a6864a7198969c2ef2b26e

SHA1
fcd4ca9aed9084efb304cc8f5512b78cb5414f91

SHA256
44d6f7fecc1579bb63c70fa719d974cdbf0193634315b41f401796ef45369ef7

SHA512
2cbb5054c56ff0a54c20fc7491d7f40c94a156cf4d44bd12f84e9010963c68d98e0534414bded29b3014e1878d381296335b94e12b7645f7c16a7260a2478555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4abc6f7df174698f5f66fffc2f73883

SHA1
c3c81dc2ff0aee32af7113d82f975d90bc9bee64

SHA256
f67304188b58688cd0793197c3addf8e3a5fcc3b081744317c2bb2b219bb1948

SHA512
23f646e15c8d87d2ee19301dd50da636fddd8d40046fd327f778b73e1edf836ac618ab8b8a6278dc1e9c6f2bf5754add2b6bf46bd7e14bd43bee277ccf523f28

Download Submit