Analysis

  • max time kernel
    69s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 11:56

General

  • Target

    https://store3.gofile.io/download/web/a294bd01-90ef-4b0d-bdd2-68f1ad42d69e/Debug.zip

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Program crash 2 IoCs
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store3.gofile.io/download/web/a294bd01-90ef-4b0d-bdd2-68f1ad42d69e/Debug.zip
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffd08de46f8,0x7ffd08de4708,0x7ffd08de4718
      2⤵
        PID:3680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        2⤵
          PID:1868
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
          2⤵
            PID:1796
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
            2⤵
              PID:3412
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
              2⤵
                PID:400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                2⤵
                  PID:4584
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
                  2⤵
                    PID:4888
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                    2⤵
                      PID:3972
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2732
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                      2⤵
                        PID:4344
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                        2⤵
                          PID:2716
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                          2⤵
                            PID:2196
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                            2⤵
                              PID:5048
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                              2⤵
                                PID:5328
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3684 /prefetch:8
                                2⤵
                                  PID:5452
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                  2⤵
                                    PID:5460
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,6491561675906669042,15066601694252719646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5472
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1740
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:5072
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:5780
                                      • C:\Users\Admin\Downloads\Debug\Debug\Unknown.exe
                                        "C:\Users\Admin\Downloads\Debug\Debug\Unknown.exe"
                                        1⤵
                                        • Enumerates system info in registry
                                        • Modifies Internet Explorer settings
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5224
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 2220
                                          2⤵
                                          • Program crash
                                          PID:5520
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5224 -ip 5224
                                        1⤵
                                          PID:5440
                                        • C:\Users\Admin\Downloads\Debug\Debug\Unknown.exe
                                          "C:\Users\Admin\Downloads\Debug\Debug\Unknown.exe"
                                          1⤵
                                          • Enumerates system info in registry
                                          • Modifies Internet Explorer settings
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1988
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 2200
                                            2⤵
                                            • Program crash
                                            PID:5856
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1988 -ip 1988
                                          1⤵
                                            PID:4616

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            81e892ca5c5683efdf9135fe0f2adb15

                                            SHA1

                                            39159b30226d98a465ece1da28dc87088b20ecad

                                            SHA256

                                            830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

                                            SHA512

                                            c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            56067634f68231081c4bd5bdbfcc202f

                                            SHA1

                                            5582776da6ffc75bb0973840fc3d15598bc09eb1

                                            SHA256

                                            8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

                                            SHA512

                                            c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            288B

                                            MD5

                                            9d01908193770d266d787b45fe2c9374

                                            SHA1

                                            222ab144fd437b4a65973823b2d20f2537692030

                                            SHA256

                                            6e259c86ac0b264fb097cd117f83da2431680e3e471c4a02f97048e9422f0d4a

                                            SHA512

                                            f679f3f2ae24ba9a15a9848e190e51c22594d644e64145bb54bec182fc7a07c359c78958c7a7de1f140b91fda1c9123e50dd2d79af48ecc849c4d7f0f4be0e06

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            9a778c2fda10c9a505dc61882d9f17fd

                                            SHA1

                                            16250ac900ad2e6c32e52f14cec76c3226b49fb0

                                            SHA256

                                            a91afa385696510e9122a042f298d214e37647240c276dbafa41adc2826ae10e

                                            SHA512

                                            83d3c5a135f1b0458ee1dfd88df14cf68ad0592d6148c1b82d936522c5373e28dd632c2c80ab8e6943470817b5be9a1e3d1f7e6911fba0e3092029d2180474b7

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            7036f66bdeeb03bf2c30314fb039a779

                                            SHA1

                                            dbfedd2fffd885bc92250efb46cd4ac2125908b6

                                            SHA256

                                            156790c322dfe0d598df3ec0876991bf90d41551b5a8bc45f4c420503b692cf0

                                            SHA512

                                            25690421f53bc22a210058c1ec093aca98fecc003899222b0a824d93c6e66cfd91901195fa6f386968576e4e07f254b5b5cfd871a59add37180eac70193a5941

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            d4aef8c524d062da339f3dbe8a284b46

                                            SHA1

                                            83fc1cae693e653f1bce4decfaf330c5b79f76af

                                            SHA256

                                            4eab1658a154eed42023b96dba155dda626d6c7ddbd210896b1701cbaea916e3

                                            SHA512

                                            e470197444f0f7f669b8bb5a946a86adb6c9959115e2a03141427add6016cf9090db1659c0ea28b54de9ee63fb75b43ffaa72c3df41f1b82c93d9ec663ebb865

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            fd060d27244d41071309b2140a6c8090

                                            SHA1

                                            6fb320735cb5eb53269b72ce862b8eb38389c3b0

                                            SHA256

                                            6f144ef22515ace6828e14a61751dcb2246192179e5c9cb10dd583c0432fafbc

                                            SHA512

                                            a17d38a7844fc2c5756160b962397d4ba9be887321aac68b92470ecdd53d5431c95cfcafc835a81daa08bc129ab91a1e01965ee841171785f9a403ff493e6b27

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            92910c3a0ee130894a4425097dc60f9b

                                            SHA1

                                            e2d786b80df0ce8cd50b4134fa8743769daaf3e4

                                            SHA256

                                            eed9b7b6342f7df3ce027c9b0e6e19368519371ec83cb8a4c5edc60723611b6c

                                            SHA512

                                            64b27292af9a2a9ac61f4ff4f841d52dadf9071bf05d6230a2a00fe2f2e00bf58d83717df0e3e7f19b44edf604c352b9607937fd887b63085deed0aa7fcdaa06

                                          • C:\Users\Admin\AppData\Local\Unknown\Unknown.exe_Url_q1yr4kdzssc4z1ioqenkit0di2go5r5l\1.0.0.0\user.config

                                            Filesize

                                            314B

                                            MD5

                                            40f1d03376d1fba4d2c01dc865705910

                                            SHA1

                                            085c02fa6f5cf9976e49ff387ae4729de883e39b

                                            SHA256

                                            10bfc55bf2598b749d968e14055e8271f08136fe813bcf09e6c4e4ec886a4ed3

                                            SHA512

                                            2831107cd353cb4f0ad85fee4b01c4ca9742f87a8ca9e419f1f1bd252614c8116764b9616cc2d47660fd7124d42528afadb45021e8bb71a118b2e515b8bf2b5f

                                          • C:\Users\Admin\Downloads\Debug.zip

                                            Filesize

                                            3.4MB

                                            MD5

                                            f9b9132e580ba02d257b16ff1b5d51ab

                                            SHA1

                                            d3d234d4ca2d07122802d52748957f9e5d882a6e

                                            SHA256

                                            40058264c50c118eae3308775868c6f0b075091a6105fb322076856f77a6780f

                                            SHA512

                                            80721d6cd26c842fc1c9f8fae09f892a19820429e7759002a27ac502cfd93900e46e0669c9207276bf7787802522a7edfc7d29e72da0601b2baace3cdc435442

                                          • \??\pipe\LOCAL\crashpad_4412_VEYNFCGLPFADVWQQ

                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                          • memory/1988-155-0x00000000056C0000-0x00000000056D4000-memory.dmp

                                            Filesize

                                            80KB

                                          • memory/5224-135-0x00000000005B0000-0x00000000005F8000-memory.dmp

                                            Filesize

                                            288KB

                                          • memory/5224-136-0x00000000053A0000-0x0000000005944000-memory.dmp

                                            Filesize

                                            5.6MB

                                          • memory/5224-137-0x0000000004EA0000-0x0000000004F32000-memory.dmp

                                            Filesize

                                            584KB

                                          • memory/5224-138-0x0000000004F80000-0x0000000004F8A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/5224-139-0x0000000005950000-0x0000000005B66000-memory.dmp

                                            Filesize

                                            2.1MB

                                          • memory/5224-140-0x0000000005DC0000-0x0000000005F0E000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/5224-141-0x0000000005390000-0x00000000053A4000-memory.dmp

                                            Filesize

                                            80KB