Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 18:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/ZXcmZE
Resource
win10v2004-20240508-en
General
-
Target
https://gofile.io/d/ZXcmZE
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
CreditCard Checker by Mirai.exevshost.exelibEGL32.cfgwinst.exepid process 2244 CreditCard Checker by Mirai.exe 5068 vshost.exe 4680 libEGL32.cfg 1216 winst.exe -
Loads dropped DLL 6 IoCs
Processes:
libEGL32.cfgpid process 4680 libEGL32.cfg 4680 libEGL32.cfg 4680 libEGL32.cfg 4680 libEGL32.cfg 4680 libEGL32.cfg 4680 libEGL32.cfg -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai.zip agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 3040 msedge.exe 3040 msedge.exe 4988 msedge.exe 4988 msedge.exe 4128 identity_helper.exe 4128 identity_helper.exe 1384 msedge.exe 1384 msedge.exe 4464 msedge.exe 4464 msedge.exe 4464 msedge.exe 4464 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
Processes:
msedge.exepid process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
7zG.exelibEGL32.cfgdescription pid process Token: SeRestorePrivilege 716 7zG.exe Token: 35 716 7zG.exe Token: SeSecurityPrivilege 716 7zG.exe Token: SeSecurityPrivilege 716 7zG.exe Token: SeDebugPrivilege 4680 libEGL32.cfg -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
msedge.exe7zG.exepid process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 716 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4988 wrote to memory of 1768 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1768 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3572 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3040 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 3040 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 1860 4988 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/ZXcmZE1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8da46f8,0x7ff8f8da4708,0x7ff8f8da47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6384 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\" -spe -an -ai#7zMap14267:116:7zEvent15591⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exe"C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\vshost\vshost.exeC:\ProgramData\\vshost\\vshost.exe ,.2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\libEGL32.cfglibEGL32.cfg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\winst\winst.exeC:\ProgramData\\winst\\winst.exe TBBjFerjgM9d6L6ew5hpP2TeRRc9aAnENBFycCsxBRR1OwH4pWmK7tRHoVDjkQyI2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\winst\winst.exeFilesize
211KB
MD559238144771807b1cbc407b250d6b2c3
SHA16c9f87cca7e857e888cb19ea45cf82d2e2d29695
SHA2568baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b
SHA512cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
288B
MD59905085dfff3385b35f34b18d370760f
SHA1223762ce5b6b420bbd340d1d111816d3fba63f48
SHA25607950958c66d6307f6f8afd378addfbe6edcf2e1184888df15fe6729920d64f1
SHA512179b950f39ebfa1d710602485a3de4666a85c96e7a823c74ec9a9f0722ad53645d5e70073c37a0965be97f1193b82cfe375110e79daccb612e2b5872aa5cee13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
782B
MD505d594d24500053766eb3ecd894cbdd2
SHA16b01856464404fa5562bdf70760c9f99cebd6aa6
SHA256911470997cd27221d08e829df6352fb1c41b74bed72fae9bcd583122d9d9e6a7
SHA51231d7d8483b2b33d8bcd5e93f2336da2a9df3e814779e1a2bff4d42a89801eee5fc23409db2195bf9059e6fc3d25b3ecb0c09cd16d4497530e8b68489f8e068ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
852B
MD5ca06f1d43f261a063e74a4ec1c823d77
SHA1fe168ade3f20e65170a692aa866d95d3919195a1
SHA2567ed1e776ac179dd39a21f3e23b520e9acb8e2e222b093b1b92c7662df1c10032
SHA5129d45bb38a3b45a5a568d809e4e547c8f85f4f1b06acdebd2d29dddf69ac233b730761dd3636270efa4fdf935b59201d189aca9ac6d36ea428f3b60f8c1335501
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53d9c6df356863ccc0a8c4c6eef1475c2
SHA14580df9dc4f8fd55dacfb74e8578f8e0aa6c1622
SHA2567c63ab6e62c3737f1f032b3ad00c96bfd99a9e659e9e4cf9e7c13c15df812576
SHA512f2338068f1977b9fa4e51b0281b7d92d8483c895567f01cbf4310f7a92a2166902035af989327987194467ce00453436570c8b7af495300a0545598222fccff4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD565b40ee1dd9b3d4757c709f56dbb42fb
SHA11d53522193705a41badc3845854846bef34716e0
SHA2568cd9ce8f9eeb6f2582c14c1d9f5982e05a8c490321934c93648fc8ec50f7e083
SHA5122d334abaed3ac372eaa17833ea510c1c605cc6e6c1b82d7103a3c1e82bbdcdb6c4a985e0fb35143823364bb9337f71072f73a68bc6e2797022ddb021b83fd074
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD512081ef4a6cb992afbee221b29f243a2
SHA15b97f3c9d5fe99896665938688a876b2fe9e6bbd
SHA256de87c04229a9b5f34dbbab3c228325a9de11b85bb8c08cb41feaf5b20e866f22
SHA512756c5b62cdf137922546ff142aafe06c7758a486583074c365f2119feab859d5bd296d62a8104b6f83f9bafe316ce226ed0e24f2035019f6c5ea20e2640fb791
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD596dcb8091d727cf3003a34580b845b96
SHA14575bed0e1a2d6ec13cd73962e4f4363b9b64506
SHA2560ac6941620ff05546b5a38bebfe44f1dd61f5b7d6a73607f69efa7357dfbda32
SHA5128bc168a8652f3063e17992b54c3649777fe7a3e9d4eb42ae8a7665af911f74adf86f8c2744a896521b014dbd49fb23ea9ebea1b321717a709e174f4751cf4102
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD52fa431fb78a8730c74c128f0777e5be6
SHA112679fc9eede2f132f8340e11ccfd98155f58fcb
SHA2566618ef42f1d546961efd01ce64fba3bda140cb06230bb36a5f7ace5942893e19
SHA512e9f75577ce377d93653c4bd5f4ef64c22eb793c024b8d2feb14656d9a2d7a1a20908b003098da503033530828e808dc22b399fb2859c9ea730d3cfe47c43ed15
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai.zipFilesize
6.4MB
MD5eddf09073f2d0729e6ddb4d661dcb5b6
SHA133cc2773795e2061c0a3681782a37506050ed0a1
SHA256cd25bd97c8d0ae446ed04545189cec6a38d06d76b02138e8c9f65573f1bce654
SHA51224944a0032d7ac99c488f94f477fb6a64756043259d27790dd263069b0f2d937b10e60760400a64d3bd6173df2f01ebe49ae097d65656343ac53130b716e4b4b
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Bunifu.UI.WinForms.dllFilesize
2.3MB
MD5559e0bb848d95c95c29273be8042b920
SHA1ba05496905a77631f274b016d6f04875a3c165b3
SHA2561566d30a46c499769d2ca541dee7add696d633ad452abf523dab321f6fd566f4
SHA512f9b8b22d22743328b151fab1dd8ca529fd4e8836c8ff2ea07562d6c30070854a97ef04a1540a2b90d8ae2ea05ae95e36264841c0c9d76eb806a01168ff575f15
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Bunifu_UI_v1.5.3.dllFilesize
319KB
MD515b2639e04e5ab17ceed3bf4dc61a68a
SHA15eb3c44c87e8c68e9926acb22cc8996c134c78d0
SHA2564c940e989a91016c1a1aeb456d9288e573c8c1bf5b64e3e38a868f98f7f2385e
SHA512b8309f2198f21dfbbaef38a3e3736fc070426f2dbc19da83a201e9fdc5eb633ea62eeb4b63e8f2d2abc4fb161e7a11989bfd7672884c03f7e3f90ec0847cf431
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exeFilesize
847KB
MD56400ed150975a6969ccbe4a3517df1d6
SHA198d314567c44ade1b97b243211fe21f380595a7e
SHA2560f993e3f3b742a7696891f5dd0e56c99b375f25e3c548eb989d0eae21003d34a
SHA512bdb855a0b267d850a5f329ea2e37e313d706c2931d0adc3ddeacc0f2a8286bddce7a104d4f18d4d9f7b6825b0ec3541823eda05dc8d7beac98e7699b802655e6
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Leaf.xNet.dllFilesize
129KB
MD5ea87f37e78fb9af4bf805f6e958f68f4
SHA189662fed195d7b9d65ab7ba8605a3cd953f2b06a
SHA256de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa
SHA512c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\data.libFilesize
238KB
MD54e6a7ee0e286ab61d36c26bd38996821
SHA1820674b4c75290f8f667764bfb474ca8c1242732
SHA256f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3
SHA512f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a
-
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\libEGL32.cfgFilesize
1.5MB
MD5147f2a8fb46d9398c4e25cc192e91aec
SHA1f179490ee711246ec729de78dfbed64ed2428d29
SHA25685aba119d7f0a649d969a5ede02dddc2bc9edec626a4b674dac774fa67c7f143
SHA5121030fb5067c738c94d2ff9526a9d2c503e2a78eb2425beae80f65debd53744b0f979b4cbf71e469991fe36c9e48a6a0fad53ec97792fa5827db9b7ad1e1ee0a7
-
\??\pipe\LOCAL\crashpad_4988_CAFSEAEGKGWNRCRDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4680-175-0x0000000005120000-0x00000000056C4000-memory.dmpFilesize
5.6MB
-
memory/4680-185-0x0000000005810000-0x000000000581A000-memory.dmpFilesize
40KB
-
memory/4680-186-0x0000000005B70000-0x0000000005C0C000-memory.dmpFilesize
624KB
-
memory/4680-187-0x0000000006C60000-0x0000000006C80000-memory.dmpFilesize
128KB
-
memory/4680-184-0x0000000005920000-0x0000000005B6E000-memory.dmpFilesize
2.3MB
-
memory/4680-191-0x00000000096A0000-0x00000000096C6000-memory.dmpFilesize
152KB
-
memory/4680-180-0x0000000004D10000-0x0000000004D66000-memory.dmpFilesize
344KB
-
memory/4680-176-0x0000000004C70000-0x0000000004D02000-memory.dmpFilesize
584KB
-
memory/4680-174-0x0000000000110000-0x0000000000288000-memory.dmpFilesize
1.5MB