Overview
overview
6Static
static
3??.url
windows7-x64
6??.url
windows10-2004-x64
3??????.url
windows7-x64
6??????.url
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...er.ps1
windows7-x64
3apps/admin...er.ps1
windows10-2004-x64
3apps/admin...el.ps1
windows7-x64
3apps/admin...el.ps1
windows10-2004-x64
3apps/admin...el.ps1
windows7-x64
3apps/admin...el.ps1
windows10-2004-x64
3apps/admin...el.ps1
windows7-x64
3apps/admin...el.ps1
windows10-2004-x64
3apps/admin...t.html
windows7-x64
1apps/admin...t.html
windows10-2004-x64
1apps/admin...d.html
windows7-x64
1apps/admin...d.html
windows10-2004-x64
1apps/admin...r.html
windows7-x64
1apps/admin...r.html
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 12:43
Behavioral task
behavioral1
Sample
??.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
??.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
??????.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
??????.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
apps/admin/controller/content/ContentController.ps1
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
apps/admin/controller/content/ContentController.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
apps/admin/controller/content/ContentSortController.ps1
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
apps/admin/controller/content/ContentSortController.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
apps/admin/controller/content/SingleController.ps1
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
apps/admin/controller/content/SingleController.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
apps/admin/controller/system/AreaController.ps1
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
apps/admin/controller/system/AreaController.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
apps/admin/controller/system/ConfigController.ps1
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
apps/admin/controller/system/ConfigController.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
apps/admin/controller/system/DatabaseController.ps1
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
apps/admin/controller/system/DatabaseController.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
apps/admin/controller/system/MenuController.ps1
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
apps/admin/controller/system/MenuController.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
apps/admin/controller/system/UpgradeController.ps1
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
apps/admin/controller/system/UpgradeController.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
apps/admin/model/content/ContentSortModel.ps1
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
apps/admin/model/content/ContentSortModel.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
apps/admin/model/content/FormModel.ps1
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
apps/admin/model/content/FormModel.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
apps/admin/model/system/UserModel.ps1
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
apps/admin/model/system/UserModel.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
apps/admin/view/default/common/foot.html
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
apps/admin/view/default/common/foot.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
apps/admin/view/default/common/head.html
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
apps/admin/view/default/common/head.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
apps/admin/view/default/common/ueditor.html
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
apps/admin/view/default/common/ueditor.html
Resource
win10v2004-20240611-en
General
-
Target
??.url
-
Size
123B
-
MD5
83bed8d95d995e087f581978b915f931
-
SHA1
73b6dab5e0bbfac6a9daa4ad67602294fca592fd
-
SHA256
08f6bd5aa39f2b8f0de7d5735c4823562272f8cd4e981eab85924839b7355938
-
SHA512
20840d27cd535d869fb1baa722ec18eb35109e6d07c604db01833c2e4a4b566dc4ed2fc123e75e0d3b7b6cebc486341b93a062472efce2490f8b682bd6e90655
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
rundll32.exedescription pid process target process PID 4024 wrote to memory of 1116 4024 rundll32.exe msedge.exe PID 4024 wrote to memory of 1116 4024 rundll32.exe msedge.exe
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\__.url1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fang.adminbuy.cn/2⤵PID:1116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4296,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:11⤵PID:4608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=4376,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:11⤵PID:60
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=5028,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:11⤵PID:3376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5320,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:81⤵PID:3196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5432,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:81⤵PID:3388
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5952,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:11⤵PID:1600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4940,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:3152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5644,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:81⤵PID:3336