hxxp://# <[:]Kitsune[:]1176628247920910476> Free Kitsune Dominus <[:]Kitsune[:]1176628247920910476> # <hxxps://www[.]roblox[.]com/games/17354987127/NEW-ITEM-FREE-UGC-CLICKER> # Like and Favourite The Game!

Analysis

max time kernel
33s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://# <:Kitsune:1176628247920910476> Free Kitsune Dominus <:Kitsune:1176628247920910476> # <https://www.roblox.com/games/17354987127/NEW-ITEM-FREE-UGC-CLICKER> # Like and Favourite The Game!

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1368	msedge.exe
1368	msedge.exe
2808	identity_helper.exe
2808	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1812	1368	msedge.exe	83
PID 1368 wrote to memory of 1812	1368	msedge.exe	83
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 3932	1368	msedge.exe	84
PID 1368 wrote to memory of 1468	1368	msedge.exe	85
PID 1368 wrote to memory of 1468	1368	msedge.exe	85
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86
PID 1368 wrote to memory of 2700	1368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://# <:Kitsune:1176628247920910476> Free Kitsune Dominus <:Kitsune:1176628247920910476> # <https://www.roblox.com/games/17354987127/NEW-ITEM-FREE-UGC-CLICKER> # Like and Favourite The Game!
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff99546f8,0x7ffff9954708,0x7ffff9954718
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7725456950152891291,12426316313104319486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cae3bbd0f61943eecfab6c44b3f466b

SHA1
e3cc2732969c31d3b49367842de6d4253fcd343a

SHA256
5c8ef9c081000ca3aae5053b699973a42509b6e61f5d6b59d1732059958d1ec9

SHA512
4e89884d7a4cb525e417cf5b2e18b7e7dbedf6236b2d173c28a4c62f656eaf170cd4e5d2742a39879ac27ac38be2271547896d05fa87b52ca81b6b5460a5d305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e77d4d6c36f5fa1455530fdf78aa346a

SHA1
4b404d2b1f3fea5562307e30d88577b92f811904

SHA256
2caf71ea61fc71984b48ec02a2fe3a7cc9cd65a38c497452c7f01de6d126d758

SHA512
428db7b885c433ec2d0e7236ab57034d2270b78742da409460279fb877ead3ec4036b71ef9677830cc8ad76083f8a2a52163db7e5bf7ea277a4e24b0c861a6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c97a6068b815cdeba68363582ef761cc

SHA1
3597ec63a82bf14378624bfdf97239c046164f9e

SHA256
d3cb6bfdb87700a4231a744fc33de19b7d4a059a2d764c9eebc15294e3def9f1

SHA512
36b019f9345090d5982565daf29cfdadda84d3b517f1130f8d5328c98f64434568b89b13377b08b976cef46b45f9d050169a062637c723ca348b949a5aab9df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e94b265bf46c20a994899382d449166

SHA1
da99b461b6990fe9efb2f5340a627cd2d25a3fda

SHA256
c88df255ddf53affa8cc18bb33f6a354dbd3d5ce3329fdde9deb983b56413552

SHA512
edb034fb5d28db98a27bf5b32ffb205aea6edfca82462467db2e9ef2e1cce963e839f31a19a4abfc14c34837815e4c1ccc6c61b399ce27006b6d1632623e4162

Download Submit