hxxps://www[.]mediafire[.]com/file/hsj78yew9239153/ChaseX[.]zip/file

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/hsj78yew9239153/ChaseX.zip/file

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
1616	msedge.exe
1616	msedge.exe
4260	identity_helper.exe
4260	identity_helper.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3304	1616	msedge.exe	81
PID 1616 wrote to memory of 3304	1616	msedge.exe	81
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 3612	1616	msedge.exe	82
PID 1616 wrote to memory of 2068	1616	msedge.exe	83
PID 1616 wrote to memory of 2068	1616	msedge.exe	83
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84
PID 1616 wrote to memory of 4156	1616	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/hsj78yew9239153/ChaseX.zip/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec5a346f8,0x7ffec5a34708,0x7ffec5a34718
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1779024510761553542,980890395928147187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
530feb867e21114c601444752ade4bbe

SHA1
709c5e94172473185f85b97e56402c97b12eb495

SHA256
e2d3b5d742c912e9aa0d93bb5664b9f59e2c758b9ea19f9d7906c603d801cdb0

SHA512
fa7c20e5058dc36692ff2a302e7a4c2805f0d19b00107c60e9aac996a677ecef50b479e76f5fa3577bde31cfcfb0a3534612f3f4c3fe58ca4fba1898d5a15abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
374fac3855ab691af7fdfd0d57823ff8

SHA1
38773bd2185581188f3fe2f33f516821b77fe9e2

SHA256
c6a08d288ad2c398536c04466b181f130b928062d5031ea806caa91517f2f044

SHA512
0a4935f1711c37953746e98d2b759a31a4b4ae749c154c539966aea3f1c8c8b831a664df095f79476243a7015211e2944fb97d95c9b8b959d85a3bd6d44de90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7ef833d9763549cb1d72920d4b9c026

SHA1
6b70f17d237b117f3936c9e98884a5a788ebac99

SHA256
4d58ed61086b0b5d276fbf823f1d58d5347e27acf55bcab8a97526d37d49b975

SHA512
6e191aa4987f0fc07dd3204596b6d8ac1b2a8c4a94bc738f08d3d9fd8777a3cd9eb9c0b202b4ef9c93999c528091de0d3c6e2e9b6970250cf8aadd0a84ebb2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9b19b489077e6778f0e65c5bf58b4b9

SHA1
6438017f3895f02d348969fb4a869521546feb3f

SHA256
e2320e2e6eb18716ae8dd49952b3fb453e92a6102928574aa43416b8ff74cb29

SHA512
5d48267371558b1f3322934e15e0dfcedcf09b55da653f26876636b80cc737a2286b9676d42e2d0d0935150dba846a52e76eddbc4c7354fc8a1b9b518f3fba92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
81ddff1b6aecb37ece54bb926724c2fb

SHA1
2b87524b47c97b51e22358feae81493ad975d2fe

SHA256
3bf48cc84c859d608d17c9d07d537343745042cd3998d6502e5c88e51db15894

SHA512
1dc105e5632a87bd60c7992bb641c7aee2f52b51e1fb58e71f468c48191cd1269e77838bdb609939233127cfa8fdd538cd8c11aac8e2dd447a9864588d06a9cc

Download Submit