Analysis
-
max time kernel
23s -
max time network
26s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-06-2024 20:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://egirls-paradise.xyz/tlg
Resource
win11-20240611-en
General
-
Target
https://egirls-paradise.xyz/tlg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2496 msedge.exe 2496 msedge.exe 3360 msedge.exe 3360 msedge.exe 2900 identity_helper.exe 2900 identity_helper.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3360 wrote to memory of 4480 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4480 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 3988 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2496 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2496 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2612 3360 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://egirls-paradise.xyz/tlg1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd0c03cb8,0x7fffd0c03cc8,0x7fffd0c03cd82⤵PID:4480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:22⤵PID:3988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2304
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:1500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:3900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8517845029163707421,5607224941790060558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵PID:4720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56f738fcca0370135adb459fac0d129b9
SHA15af8b563ee883e0b27c1c312dc42245135f7d116
SHA2561d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63
SHA5128749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a
-
Filesize
152B
MD568de3df9998ac29e64228cf1c32c9649
SHA1be17a7ab177bef0f03c9d7bd2f25277d86e8fcee
SHA25696825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43
SHA5121658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf
-
Filesize
5KB
MD55727afdcdca2b6e9a5c4def78373c0c3
SHA1717d90ef2be931f5f3ea5ef40b4952679786e4e9
SHA256e62d371ed92af2df130d96aa7aae0fc40cdfac32596a961612585cbc19f40047
SHA5126a410112fd76211a966f199398bfce37829af80f0b51cfcd97379bcba40d731c509e2006df7532f33c2350ca60e0cdc6800b3bea0eb02624e5e158bcf0346298
-
Filesize
6KB
MD5f7d49b75b34c352c012be3a595e5d6fb
SHA1c06af7efccbf0df9d2dd42d4af56a5c964f9ab8e
SHA256c9778c00cb5a422b04cc445b8dad6061892877e35e211804594b869be5961aeb
SHA512c87fa493218a89fa7bc26a455c8bf62a89c595b3c72e8889c61f227e82f2f74d582f83543318581a604ae4450ce50d1a3716b757f5537e5877fbf8e13139521f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD56a80bddc8c9ea3970a539b08ac84c38b
SHA13820b397aa89e9b3c0c2d01f41a72edf669200a7
SHA256671e5db6163ee6886c2b9b4188938b643598749cba6d7f1b2e777a8aeb06db80
SHA512e68f453ac9a3b6a7b3176ddb118f0efac512864b91835970b87d1d2140aac8a78dea0d41b3ef1d26d8385b5c6ffc81a9c4d87228e7f1fb720054f5017664a65e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e