Analysis
-
max time kernel
15s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 02:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://udang.ngab.homes
Resource
win10v2004-20240508-en
General
-
Target
http://udang.ngab.homes
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1372 msedge.exe 1372 msedge.exe 464 msedge.exe 464 msedge.exe 2800 identity_helper.exe 2800 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 464 wrote to memory of 1344 464 msedge.exe msedge.exe PID 464 wrote to memory of 1344 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 4504 464 msedge.exe msedge.exe PID 464 wrote to memory of 1372 464 msedge.exe msedge.exe PID 464 wrote to memory of 1372 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe PID 464 wrote to memory of 4604 464 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://udang.ngab.homes1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:1344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:4504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:4604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4716
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:4468
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:3508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:4276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:1620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:1704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:12⤵PID:4236
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16925726434127185629,18035874175537713110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:1528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6788e5e8-5852-40fa-a13c-b90112ac3b97.tmp
Filesize5KB
MD513acb7a7eb2f0302522e861729456772
SHA147c8b99f1abf3244270a6355ab727b93ea4f9bab
SHA2560881e42b2acffe1151d1d15e8316d6f364b89e1abc77a19738a0c4a379b9ff82
SHA5128a08a3b9e20e26bfa757e4616e469f4433ca6fe84fa5be746a970227be46bec717ca73936166d7f69b2f8b7bab0fd38c4050bd7d1bf8ea7731842f863f660a1b
-
Filesize
6KB
MD5332b2326b46f196a616bf1fec9bfc906
SHA1402dcb62a90b5047b36285f25b0ab7be39377c6e
SHA25665b96b30984affb03d2b6235db9dfdb860b43adfbbdc549bf746f22e539da4f5
SHA5123b682d9543788df47d13760c0f565f61c2e6248045aefe4280b3bfae1862ed35154b4af216cb962563e8992f60d681b93c7dbfb0eed00105efde89394edb82a5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5d3d1a08141fbb49eef134f2af9b9fd33
SHA16c3519e94523ac1936dc7fc1a9e66dfc4a0d5535
SHA256c377b70e9f37a9c7f1103e255dafd81ec68b441325ca64966bc5f21827d2efc2
SHA5129c061b4d40bde953b5fd67ed39f5af901c49ae96dca74aa83b8b60bc8578b776bbefcd36e7d6841852ccb13bc1d95f1580e2dab1047fb4cefa250acb26480870
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e