Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-06-2024 00:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://guanduonline.com/domain.html
Resource
win11-20240611-en
General
-
Target
https://guanduonline.com/domain.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 696 msedge.exe 696 msedge.exe 5056 msedge.exe 5056 msedge.exe 3116 msedge.exe 3116 msedge.exe 3116 msedge.exe 3116 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 5056 msedge.exe 5056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5056 wrote to memory of 3644 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 3644 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4000 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 696 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 696 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe PID 5056 wrote to memory of 4948 5056 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guanduonline.com/domain.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f3a83cb8,0x7ff8f3a83cc8,0x7ff8f3a83cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9375217897162547788,10096753121999150117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3584 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD564f055a833e60505264595e7edbf62f6
SHA1dad32ce325006c1d094b7c07550aca28a8dac890
SHA2567172dc46924936b8dcee2d0c39535d098c2dbf510402c5bbb269399aed4d4c99
SHA51286644776207d0904bc3293b4fec2fa724b8b3c9c3086cd0ef2696027ab3d840a8049b6bde3464c209e57ffa83cbc3df6115500fbe36a9acb222830c1aac4dc7a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a74887034b3a720c50e557d5b1c790bf
SHA1fb245478258648a65aa189b967590eef6fb167be
SHA256f25b27187fad2b82ac76fae98dfdddc1c04f4e8370d112d45c1dd17a8908c250
SHA512888c3fceb1a28a41c5449f5237ca27c7cbd057ce407f1542973478a31aa84ce9b77943130ca37551c31fa7cd737b9195b7374f886a969b39148a531530a91af3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\499e27fa-302c-4c1e-8a66-98cce58b4a03.tmpFilesize
6KB
MD5612cbf8b8fdaef0fe281ef4a0d8e7f97
SHA15db6190d6196a276d3ff5d6556621b5e1450f3ce
SHA2560b35243b27ecbb6f5b82a2925c0f5064ebdac07b464a70e4f93b40b10ac5c54d
SHA512eb4d0dcad5920ba7d72210b10e93943b91223ee70b52060d33a675102ca38919ca9296cd35669efe2f575dec922462348eae27d44c34a023e5e5ee3cc5003a39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
690B
MD511d70ef1a2359dc1318a845ac4ac0c94
SHA12e1de5e7ff7dd9a94978a0bf27f613a6d9dc030d
SHA256e7a53e8c9356e7f3c8bee8066f46de0672e3bd5f39c888e6c93a50ca2602fc88
SHA5127fa2c49b4971ba11f76aa5a7a866f2215d49238b7c004dcb1fa885bdc57b8199eb5fdbac0dadfd23d1700e0139929d85b0cbaa14afcc8b2ed0d31015a96bd54d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c7ad29864ef1303544e402c168fdd158
SHA17e8c943c39074a7fc3609b0a89ac17adac06da57
SHA25667c1a8f3861aa5d39b2012361b3f8cae75169471ef2968d6194db1a98a712328
SHA51206118157e4be2ff7be0ad1ed148332425486864768ac281fd060567f579a836e8824157af1d5c4e4f42b40f826b9513fe3a86233cb96c75f3bef1cc56ecb4c26
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5bfa0df33e7084ad77b8428e9a70a1ed6
SHA104623373ad6f20e157e4ba43a671350ec13b55b3
SHA25601b9dc186d3c34366ed9375c8a5650a9575ad63c2545440f31c9971a171d8d54
SHA5122de6a10897f4f6cd9d5f68631b5a38a415a78fcfb6d82886f98a4b9e28ffd740f59ba7c750a4e10b9655a7a64d396dcf80bce64f8901e80d26c2a1a83379c850
-
\??\pipe\LOCAL\crashpad_5056_MUUGHJFMTSLAXYLHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e