hxxps://github[.]com/foxlet/macOS-Simple-KVM/blob/master/tools/FetchMacOS/fetch-macos[.]py

Analysis

max time kernel
240s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/foxlet/macOS-Simple-KVM/blob/master/tools/FetchMacOS/fetch-macos.py

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
984	msedge.exe
984	msedge.exe
4420	identity_helper.exe
4420	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 944	984	msedge.exe	82
PID 984 wrote to memory of 944	984	msedge.exe	82
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4544	984	msedge.exe	83
PID 984 wrote to memory of 4100	984	msedge.exe	84
PID 984 wrote to memory of 4100	984	msedge.exe	84
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85
PID 984 wrote to memory of 468	984	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/foxlet/macOS-Simple-KVM/blob/master/tools/FetchMacOS/fetch-macos.py
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe931046f8,0x7ffe93104708,0x7ffe93104718
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16798790044258860775,6989871419152348960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3ab82730f8a114f8b4c6992007be2167

SHA1
efd5c0636a571f504c40e97f4eb229ac1ce6d5a9

SHA256
b944a1b9467ebf2835cfc3ecb74ac2be19b9a397b14af52d7f01f60cff0795df

SHA512
8204bb09cdef64cc888a8f0cf95ccbe45e4b0937eec263d636381e831435501f8092b031d6d0b81fadd0eca2852ec3a6eb80e5baffbec5b1a9b55bfe5239fb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
7b880056cfc562436411122290d86b1d

SHA1
2fb5f4b147bb267cc5b4f20468841128360e5767

SHA256
2c8a884fd4bb3413299265c6dab02283095e1371a3440a3b8a5455271bc33229

SHA512
8c296938564e6df7d0b49a8b6419b7a89e2d62f2382a1868562bdb83bdb0aba46371e909d51c627db033ea7fc01fa17122a3266c59cd9526a48499f100e6a206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb67c05071f9f258def9305542704e6a

SHA1
4da966d0239f4900552ec3e4a4775e3ede69deeb

SHA256
7311249848605b2864f859e9d26530111ee9c577fbba8e16638b437e1753861d

SHA512
8382a52ef3ede6bb2877658a1e232ce2d801c974856d5f45ba87baa954f1017ebba789271e2ac628a0f37d9adb53a1f1b3da0d5307427987e13b8580a7f0bbb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da6323bf029a934c1c689264982d8e12

SHA1
e5f91eaa857c99589d697d5c00fc9ab3bc46a655

SHA256
85da58adbfa8b5e2e5aa3e286adc10242853e043a2175f54a37dd0a876d7bb6a

SHA512
5a7715ce279f8930d53ebf0b66fdec87882874bd1b98ee9ed339c6aab37bfe7bb0a92e8fe47359c4e3eee8990a89f717e481597225442ad3a2402dc9af390840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84fe841a38bdaa4dd3013b13d00f2530

SHA1
606b0131de57cf46cd028b11e2f40af52fc60061

SHA256
eb1a89174c2e4788e8d39c43f6dc884ceee5e4ffcda8efdefb97c0d9094399e9

SHA512
5f84e935615ca1c946bbdbc73f2d4551a42443957586879a9e8c39abc893703d0299849235898bb1804c272fdcfe8147f440317cff96b9542f462af828837a33

Download Submit