Analysis

  • max time kernel
    75s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 18:22

General

  • Target

    https://github.com/home?ef_id=_k_EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE_k_&OCID=AIDcmmcwpj1e5v_SEM__k_EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE_k_&gad_source=1&gclid=EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/home?ef_id=_k_EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE_k_&OCID=AIDcmmcwpj1e5v_SEM__k_EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE_k_&gad_source=1&gclid=EAIaIQobChMI-ojoopnZhgMVqs3CBB27SAH9EAAYASAAEgLWe_D_BwE
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c4646f8,0x7ffd9c464708,0x7ffd9c464718
      2⤵
        PID:3888
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:4380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1140
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
          2⤵
            PID:3408
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
            2⤵
              PID:1232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:644
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                2⤵
                  PID:1268
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4860
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                  2⤵
                    PID:4984
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                    2⤵
                      PID:3028
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                      2⤵
                        PID:4808
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3752441711151245419,3777637699751829686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                        2⤵
                          PID:1580
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:744
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4848

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            c5abc082d9d9307e797b7e89a2f755f4

                            SHA1

                            54c442690a8727f1d3453b6452198d3ec4ec13df

                            SHA256

                            a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

                            SHA512

                            ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            b4a74bc775caf3de7fc9cde3c30ce482

                            SHA1

                            c6ed3161390e5493f71182a6cb98d51c9063775d

                            SHA256

                            dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

                            SHA512

                            55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                            Filesize

                            20KB

                            MD5

                            357b4145c3264fe69f8c412e823adeed

                            SHA1

                            5fcaf1043bb72dbc719ce56a173b3da59db7ebc9

                            SHA256

                            4bf695f9d9be4d4e815594d2b7443042ec14e4dcbaa6d35031cc0420b8009410

                            SHA512

                            974c8b0220e6490324f5eda5590d4a895d7d67b87414ca1124dd01ac92e3bec033623bec67b4441fd6b69bb9034d4ee8210ee0f92fdf0a8efb6546e62ef8f7fa

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                            Filesize

                            36KB

                            MD5

                            b23078951d91c38ad508e190a81517a4

                            SHA1

                            8dec45198f7dde8f6f30155817b7b03ef6eb570c

                            SHA256

                            8f951f1e047ce385bb4a999785def042031f72f3039ea096c677393bfa918749

                            SHA512

                            18da7c34c40298ebaefc6ced9b0b4769181addc85f192f258c70ac98b0275119a4e6f1aa938ed779fb73c9037036224a8b07dea403b9a5071996f2e3fa759e0c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                            Filesize

                            48KB

                            MD5

                            47b6e3b9a667b9dbc766575634849645

                            SHA1

                            54c7e7189111bf33c933817d0a97cefe61fe9a6d

                            SHA256

                            302ed4f6c8ac4312d71205603c4c28dd2976fafe4c05533c0a08ab3bdb531aa3

                            SHA512

                            a12b74ff45f6f9e6abf459863c299e1fafe61dcf2bea8a7331ed9547de14ed29e2deba69b104c6960db93b458f83ba6a4ba454c5514105e7ffb96da96e26e612

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                            Filesize

                            20KB

                            MD5

                            4f462ea90211a0170c0fac3187824858

                            SHA1

                            f90cc1b6f82e5f07739bd91b2b363e83716c826a

                            SHA256

                            c61a598483428c78349280e539bab7ae8c19ffdbe31b1c7cbd98c3a4e4a129b7

                            SHA512

                            f02a268d985f856d97df4eec61e9e16bcaa53a3bb068499723c996813afb6c93e7e980489126b21f720b580a69356001fc0c20e1337ad1f53c91071de0211776

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            1KB

                            MD5

                            097905c4bf3eee66f93461f7c1a79ebf

                            SHA1

                            4b5aa802eae1cada1cbfceca13c53eea17c91f8e

                            SHA256

                            b6f40c5b947d8a26e9c6c07467545f1a3312e0b9373df71bdfabf432965555cd

                            SHA512

                            2603ba8d340218cc30aac6b3de648572774816005a32aa53e8013eed8621784061deccbb54d9603f9f22b3e3950bd0c6ee13e48a3cd9f7158939f89eacc98b3c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            2956b5436813a9b690eb56bd4ca74838

                            SHA1

                            bc40522799c575969c401dda035b76f8982d171c

                            SHA256

                            8f30615900a598e6129ed256b2fee433980da11902a3d6d5998fd24fcc68b921

                            SHA512

                            4c7141883216d942bfc1786e96012de3f175d8706374be49a641bb9c9807a99ae6e9b6741cd398fc655a1df5d2044220c2e693bb3df44d339ebdbf2dbb9500e4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            496B

                            MD5

                            cc0727618913841fef73863dcc89bcd3

                            SHA1

                            e1516eb7330a936fb2fc1f125cd3b6d19acec383

                            SHA256

                            16b5e25adef2e6e5a3ab1189fb94ce4def489d1cef3690ecb4644fbbba33755c

                            SHA512

                            a7f385911fadd8c2398b67a373613c071f62ff65d726ea3cfb5f9e5bcaa4ccc1db902b4d6b69cb71bbc774e18e51f2e5a0fe84c330d04fd5e3287ef6007db2e5

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            e0ef1616c6c2f9b1ae1d00defdf91b2a

                            SHA1

                            b9903263aae1d781a633f1a916bb879c662a805a

                            SHA256

                            472d709ed1496ebe76ab993110f5ffb5bb97b50649fcf8df0db08ba01f8f5cde

                            SHA512

                            0affa4321b72e60d7c4cb1013b3cc76e09273577ea7fdc790cc53f7bf9942b2ceea63adef6e334da43335755c4603bc7ac2227010707b0896c5810a2cc96a557

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            cbd507e219dd7f67fe98f4e7c01c793b

                            SHA1

                            20234790f97b8370f86c66300d426aae8d2a4765

                            SHA256

                            3717f25364c7545d8e330a4c575ac4a32e6f1e9af27512ae398f4be270104c07

                            SHA512

                            712d85d2867fb194f20a130b839f039eee0926ef01978541ed18850d6e280432a426746276051e5a56a7c9b4e6b64867859e68c0930b3aa690ff3536976c6e94

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            b125fc554f24d51880d6be1809778feb

                            SHA1

                            2f942700795eabdb44a007501aa3784ac3ff68de

                            SHA256

                            04afa1722201b2a9185168e415c698bfcfd1c15cf3478b7d24f62da1dfcc7cac

                            SHA512

                            3c6c89fdb5b3da9a1b52c34a095f1f77104f2a77f1caf4edafad7a97bdbb52c97028ade33f64aea3a440532c8f3465a009b2464f61e4112f4e3e1b1880900816

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            874B

                            MD5

                            df4972dc0284d34b2f006aa83c4051cf

                            SHA1

                            3c2b29b455113d6e153a884f4fb7aa6c72383edc

                            SHA256

                            cfb5abe04ddc5a671858b83fa8af47422e9269d483465aeaa2e752bb812d3ca5

                            SHA512

                            2cb815b215721446dd9fa0ffeb27863a2c75d17bd2640bee3db72e4e339f6c81d4e8769e63a3627e234fdb85158d5e09c6ec4bd12a8f9eb87bf4582f81bf824f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            e2e586c2e4bd10d03005580c14c5e498

                            SHA1

                            69b9ba6b637d217f87faf2a140de4dc4cbfb08d4

                            SHA256

                            fcd03df370e8cd7a1a7b5ed911c767cfbe12ab03b4d3f532f63de913f786a211

                            SHA512

                            e95e36424a5938f8dde70da8399b0dd3e50d1a06aaa13ad557e0a9b911ffd58302d948518ff118ec2047451bf72a3d78b714c5bdc27cd939bcf6680ec0d045c2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            2536d1b98253c59a91e8a4882260d5da

                            SHA1

                            3dc93d782dd47078b4fc1264580f712023feb246

                            SHA256

                            4e8519c975f881fa5a200b9c98677b3b75bfd456fa2aa21b913fca3f678ed4ae

                            SHA512

                            d70acbb6a32237043aff213716bb3fb2cc2e8d74ae25f1bbaf37aa259c20827c0c90043cabb38e7abd5087fae1cfe8df5b0352bf1cdd2d164fea60ba281d1164

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ecf0.TMP

                            Filesize

                            706B

                            MD5

                            4b7dcfd1eb0312586e40391f4ce48ed8

                            SHA1

                            4185c9e3f18f56ae67b6bb322b2cc14043325b45

                            SHA256

                            3f65f257a5a86f7eb4b271f761e090dd3632f8d81cb9be77d9ccc470f8155587

                            SHA512

                            1c5bdd8b9bd17fe7bd3707058abb112fa73930c9f97deb2c3091d5cb24ad4f1a8a8a2c6aa9882ef087b138090be9daacfb2fbfd3ea133579cd1fb557fc348a59

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            29dc4cd33846230f226212f709a60a47

                            SHA1

                            67c63e056cf07c041a0539cdb7f66626ec6c2198

                            SHA256

                            5d45e1bb7961fa7763818cfa433f6f3a3b35f0a86e900e74cf0de7a641373bb5

                            SHA512

                            22777d3d6e2f8fc0074ea3590c2baac1e58a17957db9808cabdabf06c84ec6ece693db15df556e4406324f5bc175105f4c576f40b6489b4addb7f6a107d002da

                          • \??\pipe\LOCAL\crashpad_4124_PAPRAKRWFNOMXISA

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e