Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 10:29

General

  • Target

    HEU_KMS_Activator_v41.0.0/?????.url

  • Size

    238B

  • MD5

    4f0fe0efda7a1cbd40a9c07023af49a0

  • SHA1

    a76db802aa91695a0c1ed68df5534aeb69791eac

  • SHA256

    79c028a933d5b9bda29675e001107fddfa0462d06576b094deabace0dd0703e4

  • SHA512

    d6601eb15cb1d29a56edded14c8072b9ff4a4e80de4948a4c6a116cda92cfada2121f8969fa3038c6b274188cce6918e6d74d495ee62780d5fcad11213522da9

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_v41.0.0\_____.url
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.aichunjing.com/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb08546f8,0x7ffbb0854708,0x7ffbb0854718
        3⤵
          PID:3980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
          3⤵
            PID:3840
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3424
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
            3⤵
              PID:3992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
              3⤵
                PID:3384
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                3⤵
                  PID:872
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                  3⤵
                    PID:4124
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
                    3⤵
                      PID:3748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5092
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                      3⤵
                        PID:4696
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                        3⤵
                          PID:2164
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
                          3⤵
                            PID:4388
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                            3⤵
                              PID:3616
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13611513835986304621,3060084537188260954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6060 /prefetch:2
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1192
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4680
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4116

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              257c0005d0c4d0bb282cb470925e4376

                              SHA1

                              f9b8efb511ed64292568977c9f2ec255509e8f7d

                              SHA256

                              8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

                              SHA512

                              2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4819fbc4513c82d92618f50a379ee232

                              SHA1

                              ab618827ff269655283bf771fc957c8798ab51ee

                              SHA256

                              05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

                              SHA512

                              bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              ea2364d3be3430c351a63e760dbd6a6a

                              SHA1

                              7dadb5c22a408c486bf617251606d0ccc46c10ff

                              SHA256

                              36b2526769084ca68d3d089c4c2712c48c02338ad90b0eafa5fe55ab7a94d0df

                              SHA512

                              99681a1b53e8d72cd7e1d9ae65e389eda80094ec223b54d0f7127d75168d2cf7eae20c2b370ed1ab6a95e66117be34c0f938a7e7991bd5a36cfb998567e6bba9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              ebcd5192b77f9a4264a0417546b2d430

                              SHA1

                              50bfd7fa4a01dacdd1a6eff7b2f6e19688cba8bd

                              SHA256

                              6bd6f4ca4c5fcbf974535daf792f3c8ed178b7041ccd52861524dbfc5e67d135

                              SHA512

                              be2f16166be40a3cc7c6f52e81195769716cfce7783aedacb13b83acf46caa31b7bd20a016534eb831db4b8af0b6dbb23728b5d123fc13967677a38356ca5280

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              807419ca9a4734feaf8d8563a003b048

                              SHA1

                              a723c7d60a65886ffa068711f1e900ccc85922a6

                              SHA256

                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                              SHA512

                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              1d9f59243d2b1ea72246eb045d1e6db2

                              SHA1

                              9ff21abf1484957aea13ded4fbc72b5ee6b8db19

                              SHA256

                              92f3570c43e4b06e00feedc9f3911c213aadd765e592f057e99ca716359d343c

                              SHA512

                              ae39a341fbbf04f04a384dd699248abdc60430bdcb4068ba282f3d8b36855eac7488058245b6fc5f7c3f193a14e1d9a1cbed016491d4ac3a78595b4811c439ca

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              0dfe4936a650810cea3e11be124eb0e7

                              SHA1

                              028160a75e22cf683734fb45282172337dbe9b72

                              SHA256

                              04fc47fa467a241816c2db62da736aca07cb2c6af36c5aedcdd2d474aa33a38e

                              SHA512

                              b4258a96eb99a27af46736513ca59051e9dd5485be5739599fa3c597877d2629bd7c78f3d35237680079c5821f3d5656e2b46c61cec4278c36b2bce3006c201e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              92756b524f563a9609255646d88994f8

                              SHA1

                              b35736fac23508c4dbdf3b83d3e14662ec50663b

                              SHA256

                              f8327a358d14b0e5dd136bab2f8a188197be3594d2dffd623f9a0443fc0f5b0d

                              SHA512

                              98f9bf1dd87c4f6564e8335fd8cfa3f665a3ef1ba7b835288ae934d987ddaeef27a6f7d8bce13cd6374a2139f1da10530233f45d5cce128c00f4cdee82e6817b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                              Filesize

                              24KB

                              MD5

                              95cd1581c30a5c26f698a8210bcab430

                              SHA1

                              5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

                              SHA256

                              d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

                              SHA512

                              e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              368B

                              MD5

                              065ecc3290de4c90fa47a967822f191b

                              SHA1

                              ab3fe3f38210cfc57a7c0dac8fc87861071c01a5

                              SHA256

                              d2ebd2446965dc2adf350938c40b3357d955ec59ae960d21f7b018a194a965df

                              SHA512

                              e82c31ba596c9fe43549f126747b0a8e12be370f6a3a737bc4d30d6e66cb4bc7ce21d782bbd70d0ab84e60089373afa78fce10584ef06315a1ca19e8eb2e2045

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590e2f.TMP

                              Filesize

                              204B

                              MD5

                              178fc555b2cb900c39b0cdd5cc01fe43

                              SHA1

                              8fe8f4fccd92ce6b592e70adda75717e43a251e0

                              SHA256

                              8b6b250d1482ed7240d2989b166a8f197e229635ab4a1b2cb35b47c26d361b22

                              SHA512

                              deddf31b455fccf28855108b1ca9722cc4abc96ab765a04a7963fb4472a9f5e47288a098777ebd54c3e7adf73da428215629a0de345a82ee1f6bb2257e82c2ac

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              9476606e5a793b42d634f2a87ef8e21b

                              SHA1

                              20e29ecc16b5568ab7c2c313f90f52cec94c5900

                              SHA256

                              6be93d190f32bead1d83e5aee2d765116946dd9de30320665405285a6ba2e3a4

                              SHA512

                              c4e3177714ac53cb58c1239ad45fca4c9fb0ca15c3e8667a96a01024f7fc225a77c1898cb27df5a8c325e576dff650150f0384175373aecf2d22b36d0bfc97ab

                            • \??\pipe\LOCAL\crashpad_3644_MNKBFFKPARFVNSVS

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e