73088948fc29272b4fccbb47d59a23906d556c420bca1d72e2ab747538cf5bd3

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Synapse X Revive/bin/ace/keybinding-vim.js
Size

214KB
MD5

6d6c882a60bc5c9438a34c5eb6f61741
SHA1

df0b965aa247fc3b012c249e534f611d07a587f6
SHA256

ca45d7afdc5519b3c42bb8d0bf5735d3d600c4876e2125151290daacbb6ca080
SHA512

9e18539f2d26b18da843a6b0c5e4ee81a12cb6b60fc7223c42f06a6d5bb61723a60c69129de920b4132bc9f8d6ef955917ddd0498ec9c8ab3601cbfce1d9901e
SSDEEP

1536:er1XS+KYfa2qeadsFhbllk0SwNRQ32bvR9vtcW4DrgcxerB5Z0V1Tr:erpSRYKeaalssrB5Z0Vhr

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1552	4040	msedge.exe	94
PID 4040 wrote to memory of 1552	4040	msedge.exe	94
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 1680	4040	msedge.exe	95
PID 4040 wrote to memory of 452	4040	msedge.exe	96
PID 4040 wrote to memory of 452	4040	msedge.exe	96
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97
PID 4040 wrote to memory of 396	4040	msedge.exe	97

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Synapse X Revive\bin\ace\keybinding-vim.js"
1⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa26d146f8,0x7ffa26d14708,0x7ffa26d14718
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2969690734512261092,12089583590816008287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be194769cecde6b5fd34988c0f91ba59

SHA1
b4f82a010bbf84a382b3d634488d33605022c23b

SHA256
e2b1884db5b522ee07b802388f896a68953c4944173f5059ce20d1c82fe586f4

SHA512
650bd70419ac8ed088946be671608501a34c1ebe5649dc90640f36093649bb0343f81f7f73284ee465b7ba66cf15cf36fa75986964de5b26f5819ea1deabc31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit