Malware Analysis Report

2024-10-16 06:24

Sample ID 240627-gn7k9syamm
Target UgPhone_install_1.1.23.exe
SHA256 9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d
Tags
discovery antivm execution
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d

Threat Level: Likely benign

The file UgPhone_install_1.1.23.exe was found to be: Likely benign.

Malicious Activity Summary

discovery antivm execution

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks CPU configuration

Reads CPU attributes

Command and Scripting Interpreter: JavaScript

Program crash

Unsigned PE

Enumerates kernel/hardware configuration

Enumerates physical storage devices

Reads runtime system information

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies system certificate store

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-27 05:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240220-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 220

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240611-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 220

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240221-en

Max time kernel

133s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 2112 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1080 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1276 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=renderer --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1396 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1080 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.200.14:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r4---sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4---sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4---sn-5hnednss.gvt1.com tcp
US 8.8.8.8:53 www.ugphone.com udp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp

Files

memory/2588-1-0x0000000000060000-0x0000000000061000-memory.dmp

memory/2588-33-0x0000000077410000-0x0000000077411000-memory.dmp

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UgPhone.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
PID 3892 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone.exe C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1588,15653115576260134116,3633441977201316162,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1596 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15653115576260134116,3633441977201316162,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2084 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=renderer --field-trial-handle=1588,15653115576260134116,3633441977201316162,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1588,15653115576260134116,3633441977201316162,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1472 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 www.ugphone.com udp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp
US 8.8.8.8:53 248.15.206.154.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/1244-2-0x00007FFDF4610000-0x00007FFDF4611000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State

MD5 55c27488a6cb0b3d088f2cd1b1fc6619
SHA1 fba84859e385865e7c16f16d66de31852338ca96
SHA256 d4687fb74330e49a39c70ec2483c7729c2b3b07488b9b416290c1b88e77acf3e
SHA512 35da27b00123fb942cf86566de4997bf31f8876f60d5baa27b501f3f2ae47426c3cab7aec88a51fa796bafafef9ea099024e4e79a387a544b52edade085cef73

C:\Users\Admin\AppData\Roaming\UgPhone1\Network Persistent State~RFe586915.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

167s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240611-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe

"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\chromedriver.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

ubuntu1804-amd64-20240611-en

Max time kernel

0s

Max time network

135s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

Enumerates kernel/hardware configuration

Description Indicator Process Target
File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes /usr/bin/node N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/meminfo /usr/bin/node N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver]

Network

Country Destination Domain Proto
US 151.101.65.91:443 tcp
N/A 224.0.0.251:5353 udp
GB 185.125.188.61:443 tcp
GB 185.125.188.61:443 tcp
US 151.101.65.91:443 tcp
GB 195.181.164.18:443 tcp
US 1.1.1.1:53 1527653184.rsc.cdn77.org udp
US 1.1.1.1:53 1527653184.rsc.cdn77.org udp
GB 195.181.164.19:443 1527653184.rsc.cdn77.org tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20231129-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 2316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 732 wrote to memory of 5088 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 732 wrote to memory of 5088 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 732 wrote to memory of 5088 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3688 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2712 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2712 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2712 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2712 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 2112 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"

C:\Windows\SysWOW64\find.exe

find "UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2152 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1448 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.ugphone.com udp

Files

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll

MD5 c42523771879bdd3f754fbcf2f5d787a
SHA1 55f9496131ba56a00526d92fce1c8b8d669b08c8
SHA256 ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200
SHA512 ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin

MD5 8783eb563bab1d720f60f64d38f6ab69
SHA1 41c84e5f448969db07ce505aacad4fe574c9eb8e
SHA256 b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c
SHA512 f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak

MD5 1f95be6a00b153fd2ba5b149c21e3c25
SHA1 d955b861c86e1d3de73024b3383aa11264c87ba4
SHA256 f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715
SHA512 9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

memory/1584-236-0x00007FFA47B50000-0x00007FFA47B51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\39cf6da1-29e8-434b-ac85-0589f77a8fe2.tmp.ico

MD5 95869702267b1748d648dc6cb57bcf3c
SHA1 89804bd5f6a8b38863e552d0844e21a6fae30b56
SHA256 6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d
SHA512 387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

C:\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll

MD5 f3c8fea015b42bac6bdc0ddd3eb0b313
SHA1 176d3bfd15d22835e6bdecb7c39f13e4a29676a4
SHA256 b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1
SHA512 30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

C:\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll

MD5 7969ee5f940eb49840749fbbd4358c44
SHA1 12d827c416ad82f5f622e67683f2f7df65e809e4
SHA256 d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4
SHA512 e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1584-317-0x0000020F716A0000-0x0000020F71DDF000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20231129-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1612 wrote to memory of 1916 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1612 wrote to memory of 1916 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1612 wrote to memory of 1916 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1916 -ip 1916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 612

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3432 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3432 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3432 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4036 -ip 4036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240508-en

Max time kernel

134s

Max time network

133s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425629900" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{908D99B1-344A-11EF-BAEF-F2F7F00EEB0D} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ce466557c8da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004469ddafe4352d8a9b2cd4595734bdd0d165b5dc6167aebbb29219a70cb5dec1000000000e8000000002000020000000818f36197369c2d9d1641c6562d6295f583e70397c81c85a86f5bb01fbca5b302000000044dad98714ac5a0e0faba3656cc3c82f40f25aaedc0642918a4334d8b80c457140000000d830d528e5a4106fadb7a95ee31f6302d2b3e4a6bc14793c28bd7a9f659ec95ac4ab114e32ca9ed88218c386be2b7bd4d637b6e8787075e5ea4bfd744c01d14c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000012ba68c04b26c3fa87ef80703752f80d07f4d108d36df776610b312aa74f6cfc000000000e8000000002000020000000e6ddc32ece13345de1e4a37cd0b8dd474f377904d6011d11588f9fda73ba7e90900000005b92169ccbf569da9b9ee082d233e13a3ed7d2244c0244d6377966dd6b6e7bfa042f5eecb969beaf345af39936d5cac39ce552a0bf05f41ef8d6a7b0e0bd5fc59f509f50d81a7ee52b1e4bc5e5e9f8faac49aca2cc9df22d367de4363b077c24e44bfa40b96e9d2038aa5e904b46babb6d350690bf1a0cd09b6ca025c4f72407db22ef421171916ce6fca16e4105d706400000009c292b5825b2ae73120c0dc01addf215776102391b8403a37875c023eb45fb169d758dc7cd3a91f704a3b5bd6c93529534bf4cca8dd2fed613d60aeab372f418 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab45AB.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Cab4639.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar464E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 21caa221aa2d0c6441af4637d2e54eac
SHA1 8fe62c51978dc791a4e22c9b943799b125e13bf4
SHA256 e936144b63a548926302f06092f7f8644cc795087d33e65e87e93e0d3819209f
SHA512 89d8b6abd66b49b205069aad339e3a7a630330738535f4b4a05a2ad02be914d070bf3799d576a39891cc18c09b561eadf5a442efeb93b50de370d1da0fa988e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3efcca916fd3b7d24cd8346e336cac35
SHA1 d24aa486664d92368cd551a39f7e0f3f3ee73400
SHA256 d5886a286c07fb03b1e331c3428c40783485628ac361ed836cedca2ae0726aa4
SHA512 b8b12e0b5026aa420624ed5b8a2ae6b8f200ddcdfc4804e53c7cb240e02f3556a7504205d2cbe83026deb375627457983381d2bac312cc4a60c120019b435881

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2564e5a15ce931f6372b546152e86fe6
SHA1 c6a77a617d36497aa74dde0cdd8b1c4abd992a22
SHA256 484fa3bfda059272fbd8aafb3565ad69afea442789f5ecd95278a10970a7ca6f
SHA512 f6b87771037c838bf6784153902ee2d88e7c3992c4614888f4f4cba2c54ce1de2b86d221b98056840010ea7e7931cef600efce8f04940c231c73e0aec9ba4a37

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5047c09055149b4b1b169ebac5b704f
SHA1 e07e255f8609b5266cc46bba64f44b110d2ed37b
SHA256 e2d3324addc41cca403d117e5e2b00442b9f2ab32bfa4ee46caf85a0e0e5960a
SHA512 275d4492979960bfe23a6ac8fd6c8ac0f7258c136d7262350c1437ade099d639f6a9939b37c93fe9ad86ef9d903ce693752e437633e85e42e3a757b839d10913

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7326338cdd5a020a9ae4cf415f0d951b
SHA1 7e6bcd137c170b43e829aaf8f1ca68ff02cbbc09
SHA256 109471e86ef6012fdf01011368e01eaa863abdee4aacb295e42d3c40c87b2bb8
SHA512 cd5fbf458a24aecb5119bb91bcc4cb95b6d48d19b44ba1b729b2e4111deea94cc0eadd7878e588d9aa43dfaba8704bdc24c58408ee8a0d40e56e7d5711df6103

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8c6c2233ad0fcad9a046a0f8baa075d
SHA1 31531124a8325c180b5a2f1dc2549c7d97d8bbaf
SHA256 d532f50b2650375242ac79262855090d93d1d2f9f526ea99133bbba6613a47fd
SHA512 4b8d75ee529aae67954c8d4ddedf0dc5cb2e14ab2a67b2343ea6426d2200c5c7b42cc47e705535be4ab4d1523405ae2a4ff4f8c58a35ef9e0be0a3ff54d56efa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e056993cce67519919b3665bc9844e1
SHA1 d94811ead8400c367f1cb50c48783980d54af550
SHA256 f72141a414a8fec4d0c924d4650fa58213caaff1abf3bc646541b76016e1e6a7
SHA512 a70683c52d6097e22bf9a6505b09dcf246bbc83b631f47cda7f404cb8c6e05ac1fffeb45b50a6080b25ab1a76f2963afc73d70b0b50a16092712354b7d5981c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 beb8c33a9617041add0f75f69bf7e1da
SHA1 b8cb6e70f3925a0913bec99dfb9b1ef9747c486a
SHA256 c687c0e05eb3b033e501592987afb0df0736cd58eebd04297ee3ec34e93d2b5d
SHA512 2fd03e8afa5c49a382ca22d53ef7e92412db77e602b0abbd76530e1cdab11052c83acc1ea67e5661f85e4704226a9915b41495922cbebb415784b2ccee039d64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4cd9d6e75e6be26b8a1a7c941449f9f9
SHA1 8e44877905a16ac2dcff1f1d141fd50f28b78df8
SHA256 fb23ee45b03e1ed088cf3da80f9592518229d2b4bd2306ade9d67648139b922d
SHA512 5d66581131546189d06e707a29f8ef6dbc47994adae6f1b9ff02527f7271cce7cceae3bcf180a777628475396c41b9e407929689eda5fb719c785145dc35119c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e44325e22d80559b901198f02f780b3c
SHA1 7ec5834edd98ece003bdb6ed1ab8901f2f7b5f86
SHA256 e89564ea20f6d8184ec4f4fd04dac31f8d4d0426b04d6e190aa281763965ae64
SHA512 68ddb26105903a813e8f626ed75c26cf2d3f26f19906bcebd1d5ea4079394f9df58169533d67f6d2f28b2f084608abece706eb920ea09ceb61a0d10e0c8d1154

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d92e28da31af178ee427290d13a6c385
SHA1 b2b6ecdfbd1fd5c82f08a4ec9ee913fb2b9aacb1
SHA256 a2ff6f5b10fb5b104ec1ed887d7980e1eb24c0364f8f8bba244999e6ed94ba34
SHA512 a8ad2459917bef765330c440b53b0601d853909578418cd5217bd815e9dfa8c8f642b11c8ce67605b07509114a04703f49fa0b17f83887fd8995f6f7c9c8d786

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12b254382f010df3fc48538b872e2868
SHA1 9fefb5bcf135527bfd2c0952845d618498e386ea
SHA256 6684b268d4e39afeb48259dae62046ad3f2df234abbe75e9a3009b2184ae8681
SHA512 7501c2c5902b889901d2fa00c6c5f9d5263991947a110972ab2c1491e827c2b3b96bcc6da46ea90f14e63bc900b1ce69fb99086a699def2c10c71ea124b4165b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d2af74ee36090511c746fe72dbd5038
SHA1 d4fff09d5560314d0335b78759868a4a32b969be
SHA256 bbdb20e7b6d7063d1163faa7a31a22d17be3b3ba636c604bed55bfff814de22f
SHA512 125d75e3e797317eab8ed7012877e4b78b102accf8c03f1fb0cf701fe74a0282baeb41f4403410a4af54f762b4a77c080177142b736a5cdab6ae9f2badd7a282

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c384bda277b73a52769d3522e19ef0a
SHA1 ad6e8606018b1574eb39fe1a36de8e241d7a1dcb
SHA256 04cad86e5a51a010b05785f7b7325f33dcf9322cd1a5b1042539b1d6a0eb056c
SHA512 9d31239e8837d7b422383fa5784493a9ceae5fab2e73c489669e05b6e0f75805e398ba62d31b1e7b16640224ca7eb3d285d56c359e326a413ab38da8adeeaf25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8763b36d9f9682c8ca51f6de8ca14a2
SHA1 db067c082bbc5a533bc54a170e76e94c0905cfce
SHA256 cb1f0c2bebf1031c02258c507973860281b3adb3628be714cc80a9aa794cd841
SHA512 e04ab2119c25488ea3ac81d0ab688d34f7c97160676e494fb3ed4c7bef287e039ddfa31fc5c1564535929f4ab74e7c60c8acec3575cd21ac35f9f16f81994d13

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9bc23f9d1ed45ee7431fe21c2c76f7d7
SHA1 69a6322e403e5c4e1120cef9a90a1513d3f9f7b0
SHA256 2b0d44da1b920a788938fdaae830e7f2e98a1ee02958e624233eef8419ed4be7
SHA512 90a677846c92e325a92f11746c9652bcabbda4d57ff26a425d4853e6abd55d1370b7bf7f02379e41eb19b318fdd15f92df032934cbbb39f9c6423a9256da5fc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e47310a2ac07c421d91639d9ed3b29e
SHA1 8cd1ebb26e101a1da6570a17e18780896e59adb2
SHA256 55cb364c2d83c8c0123f510f017f439630491ab98ffaaf5473839d39ed83c31f
SHA512 547569403b4150203d3e88c853dffe488aeb99dd5ceb5526e4651a83debbec88b8c41dc2a131a5c213ba2c8d9efe36b48bd6ef95cff18a36f11150d8b89ef258

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240611-en

Max time kernel

120s

Max time network

137s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240611-en

Max time kernel

125s

Max time network

159s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5028,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5016,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5516,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5728,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6040,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5796,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:443 www.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
SE 184.31.15.35:443 bzib.nelreports.net tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
NL 23.62.61.97:443 www.bing.com udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 52.111.243.30:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:04

Platform

debian9-mipsbe-20240418-en

Max time kernel

0s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240220-en

Max time kernel

140s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Checks installed software on the system

discovery

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2604 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2604 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2604 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2604 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2604 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2604 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2604 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
PID 3040 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

Processes

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe

"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"

C:\Windows\SysWOW64\find.exe

find "UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1304 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe

"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1056 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.200.14:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r4---sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4---sn-5hnednss.gvt1.com udp
NL 172.217.132.201:443 r4---sn-5hnednss.gvt1.com tcp
US 8.8.8.8:53 www.ugphone.com udp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp
HK 154.206.15.248:443 www.ugphone.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/1892-233-0x0000000004130000-0x0000000004132000-memory.dmp

\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll

MD5 c42523771879bdd3f754fbcf2f5d787a
SHA1 55f9496131ba56a00526d92fce1c8b8d669b08c8
SHA256 ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200
SHA512 ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin

MD5 8783eb563bab1d720f60f64d38f6ab69
SHA1 41c84e5f448969db07ce505aacad4fe574c9eb8e
SHA256 b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c
SHA512 f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak

MD5 1f95be6a00b153fd2ba5b149c21e3c25
SHA1 d955b861c86e1d3de73024b3383aa11264c87ba4
SHA256 f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715
SHA512 9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

memory/916-284-0x00000000774B0000-0x00000000774B1000-memory.dmp

memory/916-251-0x0000000000060000-0x0000000000061000-memory.dmp

\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Local\Temp\dbf305c0-5a64-47b7-9ea4-1c746a4a9357.tmp.ico

MD5 95869702267b1748d648dc6cb57bcf3c
SHA1 89804bd5f6a8b38863e552d0844e21a6fae30b56
SHA256 6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d
SHA512 387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll

MD5 7969ee5f940eb49840749fbbd4358c44
SHA1 12d827c416ad82f5f622e67683f2f7df65e809e4
SHA256 d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4
SHA512 e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll

MD5 f3c8fea015b42bac6bdc0ddd3eb0b313
SHA1 176d3bfd15d22835e6bdecb7c39f13e4a29676a4
SHA256 b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1
SHA512 30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libGLESv2.dll

MD5 fc99fc1d991f1404ca20cc8178b86486
SHA1 15f67bc1d25a0af8ae24dcdf542dbcbfc3b67317
SHA256 7ad5bc738ebc7b58afc31dde170157fb9d0eb40819b12c08e1190669da998310
SHA512 48c1f78d0d002a07bdc76c8d88f8ee76200999d3cdfeba88de49314094da233d5ea9373cd23909189aed29f512d6f322d8c62ef470cfe4a6362310f56019d1e4

C:\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libegl.dll

MD5 58124da1da5854be80f519f563cdb331
SHA1 353fa846229bc2c2f3479d774d84aebb66ef3eb7
SHA256 a03a044ea9775d372c4fe7fd82e64ab18e052bcdbc9381c2030ca475bc2ef1d1
SHA512 7f1af1e2237f6fe1eca1c4de4f3319979a6526c1938aadd48d7ee55834b7479de152868288f32084fb3004d3a420affca51091e83bcb4c4840a727664b69ee23

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 1800 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 216 wrote to memory of 1800 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 216 wrote to memory of 1800 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

156s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 4792 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 4792 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4736 wrote to memory of 440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba6c746f8,0x7ffba6c74708,0x7ffba6c74718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5704769181454563319,4452052564841596448,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_4736_TAKIHWRTCJUAQTRV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1dc9f775f237e0421edd404e7df45c4c
SHA1 350249ba807fd1a3c59ba916c76c4c28cd666beb
SHA256 9fc26f54f4763373bd7a87fb9dcbd9a7e392b9e69ee6031f6cda105aad2ac236
SHA512 232b5b52cc0bf62f4326fb83b8744b2fa646053821864986003daa2fe46a980570e2289cd8cc833123cdd61c7ce79c93c5262bb14cbdaff5dfaf7e81cdd243f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b8cbc9637d9ebbf0175a1585d4738718
SHA1 08903da2cb7c18e1c47426441333095421d57df6
SHA256 4a140606f3075ca05f004e2e6c85d6d7403026238bb255e6cb8acb7fcae77ce5
SHA512 99b19e4283c5f739feae6c82360410a8d588d26eda372deea4f5421ddee5943d992503761719b9bfa8cf6edf0908a0633939b6aa2c7d85573b4e53fcd3c24cef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5c7c67b37f0ba418340bdfc136f29ae1
SHA1 ddc0ed2fd80c89e89823c8c122c9e929c02b7184
SHA256 1715b5bb989c2f58c955f9dd1aed6db0e69e690c9f1916f916fa7caf474f4f7d
SHA512 83d52393ecf60a3de4512908255eacd4c94fc50b5c5228cde83f2c4e1243af5c2abfb6390a316ab2b850a22bb8ccdb1fcdbf806e4c27cdf76921156c8691d600

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240220-en

Max time kernel

118s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1640 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1640 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1640 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1640 -s 88

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win10v2004-20240508-en

Max time kernel

74s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

debian9-armhf-20240611-en

Max time kernel

1s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

Checks CPU configuration

antivm
Description Indicator Process Target
File opened for reading /proc/cpuinfo /usr/bin/node N/A

Reads CPU attributes

Description Indicator Process Target
File opened for reading /sys/devices/system/cpu/online /usr/bin/node N/A

Enumerates kernel/hardware configuration

Description Indicator Process Target
File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes /usr/bin/node N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/meminfo /usr/bin/node N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver]

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

debian9-mipsel-20240611-en

Max time kernel

0s

Command Line

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Signatures

N/A

Processes

/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

[/tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/local/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/usr/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/sbin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

/bin/node

[node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js]

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 220

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240221-en

Max time kernel

133s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425629907" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e3ff353921dcf4e9bd15ffef315904f000000000200000000001066000000010000200000000929c8c1b42a444e04eb262504bca219f2310511c0181b02c76f0ed92e0fb3dd000000000e8000000002000020000000a52bb5bf68ea949037e092556bcc2db23081c433d17afc07137b24e3403a8eb8900000009d8b6d353f34277c092e0ddbdb328e440fd3ceebfba33a72ba9fddfbc5902b5006e5c70ddacf0407f5bbd7f1dfbcdb055d895557f8a45ebd3978e8ad6d0d5976c96735215f07023f2ba403f8bb1fb560d859f158184d55624be2962ab87176b7e09365e17126f371a17ea04e7279e95049d8f4e4c067ce297471e2711b5c01333875e60693ca0c619b77fd58328907e640000000a58c5a762ffea6e22b7998404f50daf461894735ca2a5d38177a5ddbfccc9d748fdb02ae852b8d416928235b181cde28cef77714e8d5271a1a6bbbc754e98040 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e3ff353921dcf4e9bd15ffef315904f00000000020000000000106600000001000020000000a61e7d474d4f41a9f48632c24ccc068350eb967e738aab91adda8aefc7ce2dff000000000e8000000002000020000000f2e45c60a2b8e368e423b9495e2b2baa92134840203be788853b6b0a27281f8420000000e1c207107057321a0f4660e976d770d563675702903c62ecf85de33cfa02ac85400000004968a13d22b208544f02cd7fe9ff57408f79eaa1da01083dad14e04fe17d32b3f4fcfac1b158bff8b7812bbac3df8ebd092b7833e64d7e99a6c03e49eed92805 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0093936957c8da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{949D0771-344A-11EF-A38F-E61A8C993A67} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab55DF.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar56D1.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6afc3525dd85945a54c3aa9e6ebaf4c
SHA1 86d22676ee97a292afb2c1d5229f49a93315704e
SHA256 71ff6d15a73b54a196acae96a87df102d72b36adab1092260288fca4b0d19814
SHA512 77e61d37760c1c0d92eb68ffe828321a141a4681573b047271efed2289e3c0a7cc30fbb6bf3a093189a2150a6e774c2fed7a7081771f1ea9470b470e5742a286

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 093e244a0a8d69335dbbf206ad833d3a
SHA1 c7242af9b229204d2459e4b9675623f3e63106bf
SHA256 9b1d42646f8bc9c8d10f9f7da14934b6d7641bf5cdd0d442e5e4830ab1ee771a
SHA512 7881eabf41855f811a0bab092335b02d40c1b7a28eb1dcff5e656c5ffb618fcbbb5783cead28148a13b5d6f3678a1f8b34c2911e279bf9abc6f88ab43513fd56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87cf0989e456ef08197fbe92a5e9aa16
SHA1 5e8642786fd14af13b83d765b386e41f72ab49da
SHA256 9ecab5193c0fde775bd9e99af07cf53fe770119043f555090acdf42e5b902819
SHA512 be778e49072c1ad8cba37793b12d98354321cad33deb580dbea35e18925b3945ae3918a088871ef0de67863748983a9aad4813296a6c9bc61441e51a5e30ffb2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb417c75527b420213f70bd61c401d80
SHA1 52504a273e42f1108fe6af8871636ad5b8ee26da
SHA256 a58d9aab30f20de0d3a57384379878bb7951d74f944b3d3023852dfb677400d5
SHA512 95aab9f944447c131c6304dbc7dd19c4cb2a84f420a49acbaa7b6671fefe5ba827d6bd09af2b4dbd13f254fe87e9469f1c85a43643d9ccc06149d8a5425a4676

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc675c44ad668170ce93d6edd5ba75e7
SHA1 cef8a13de2fbdeafbd13e07a3ae948b4897d190f
SHA256 d120b3351cbb60c33d7043ee2dc5748118c8e5ce6f93931d1ed91293a6eea3a2
SHA512 9bc9e524205a01b9048aecdfba3779fc75285df56a41c4caa13cb36163045917d062232ee30fb9847072fa02b23029bea126fe746a1b18377d281ab184f52eec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 012e18d0c79718127e7de36d7aa670b9
SHA1 57ec47cb44e98f42418696145b8d7f2ca19dbf91
SHA256 89d94c09ee71fc6e2f2568f7cc5034afd970672202aaed435101dafc4b517f69
SHA512 a4d9bd87369d4b67eca41ec11632aa56669208d22bf12beeb57dde63238ea9e1b451ab7eb6f0b89e14a083befeca3505396993d101ddca871bf7c42146ade03a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b598ba30e28fd05f77f2760a3e4687c
SHA1 fbf9d09d9139c009a1a7f45629cbe10b64f95e4a
SHA256 e83b9d5bef5cee78a631f2436d7264ccecfe43bb4cb936a99ab9dff74b9ae42b
SHA512 6142326bf7661be960714c8d784751917bc8171e5d78bd1ea65608a2da54e493a7bb04a571229d12e2bf4f548f849790795883a14305c9c9b2ca468bc9ef378c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16802a1579efb978d9b402184d534f60
SHA1 371d3497b465824b523061e0c51815dbfbad67ec
SHA256 e59f086988fab46acecc2fd2e4a0e08012352ae20612c2ae1f2298a750227629
SHA512 f8f788e676b03424f17c708b732e44b1a1a9bac028f8c47947af6139da593b51688ee2b33226b199fe40113f0367f829cbb1d81509b4d4989f38bf0116fdcff5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 090e4d6a61346f1393c2ba2dfe71fd4a
SHA1 09e483a80924e044e4d18a2d7f01ee116892d2ff
SHA256 ad36032d66742c62e275283ae576a9a7961b9b7a2dc4c11f97e7acbb80cfc65a
SHA512 fa72c8b870ed0a1b3741a9ae768af84f633858bf795be3b0020e1d24da3b9f6f19eca54ca14b2be297c331d84db24bbcb76d72aef7292542a96a9685efea478c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 588a3654a931e8f34814cfc456ae98d6
SHA1 5b853be983cfa8d6947e8abc4c7286a5cfed0a07
SHA256 e12cb761ec99dbbb85677f9bc0d60cabed523cc787a23a3fb438ddcb6ee83202
SHA512 7d2fbc2f0e96fd122b684275c513e147b1c68ebf2d2a8c4186ecbf40e9fbf357d37ebad3e372176a8cc0a0e27b32565ffefdd13e260edca3bf686a694157f0e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b8f4173b42a950234df66627cb12123a
SHA1 94f5a429571b962187a9ae8e1d443d80a04f9e95
SHA256 27b32e35e193edfe435bfb7fed6e1cbc5e90a6983e339406502d45855e2fe1a9
SHA512 d9a564297b3dab6e44ff44554a57883c497981010bb1c49e65c8c9364417e9286e41ccd1a11f1d308700ff3a40d09bd54eb18afda20325fecc4777bf977c5390

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7429281476d3bd65bf6749d71cb0bc0e
SHA1 2b57df013025746674065057bebac9e93e985ac9
SHA256 722523c61488922a9ea37f4a94f292ddba85a8f5967198a96755094342dfdd38
SHA512 628397e38bca0f5ef21f2f461b768badc0d5d28b8ad69171c7744ae49d165ac8deed301f8f116159a6ccfe2fa7a667bb0c44e2e272c90138a40eb37d0e82e289

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ebdbcd5aa20369620dfd10ece79d4f3
SHA1 b52098a61c1cabbca7d7e282c4e1b9bff473df90
SHA256 49daa8d6a12832bbfca0e90469794661b984c56b9623ca695b7483e10338f30d
SHA512 ecab588f5833a055f8eeae1a6109b8103ea4eb83401c30005437e12500790fbbb85fb0435e59363d1056c6daafbe6a6dde97fedd19e48df011f9eaebf8bbf6c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce44edb0cf08f74bfca9c501b8b1f08a
SHA1 45425682fabb0bd5ebe7f829eb5e83df2a6389b7
SHA256 a569b33163d64bf63c17d858ec6d076fe9f6beb213e8b8c5583b96454d29541d
SHA512 fad0e4d3258626d1c5c796d70d90958ec88156e89b7cc6bcd3a058f291ed705744c2ef386ea94495d446edd9eaa4655e46643236c9a18f7f196f6d5885088a5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b027efde8f2a94af44c62b791af5e9df
SHA1 e3603e79acc86d45db8bccdf028ba862bf128bab
SHA256 39209275a257615d0c3892de32f0e7a94faea7a9a5922cd0207dab915713dedb
SHA512 9435a589926d8709d400c921ec3fdb5699fa8c08bf1e553cee624861b3f63af1379e50bcd2f2023d349d97da1d1cb8a307d8ea17383c6cedc4fe504484946c71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4440e1a005445d195e8031b9627efd6
SHA1 d837791468a6739abbf21502a7b3c0ce5108a30e
SHA256 798671d9fbc7a162d6a58aa249776d76da6cbad5f9137c120f417fb00a27a885
SHA512 930be836b1fe5e08504b209debf6add24723cf7cfd4e05d1792c3f3c8fe1c82244dd465e3d43bc864ddb1b9435417d39169f831ae34712f435f67ffa290e696b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca952805e5bf66b7f2263a9980fe8a0c
SHA1 b331e5970f12d970f68a439279d98bfc570e278f
SHA256 fd24af40bafaa1443b6ac13ca2286d19da5d0aedf47ed68f490b3a9c231dbc60
SHA512 0b8fd5a209381f5b8b1efe2f15a9ca32cae5735d3e72fd46e827e9614d523c5e27a5c7332ab38ca79643471302626887f1f960915b53bda1cb09eb0b31b7f3b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fbdd41afa82499f83ca2d46fd26c7b5
SHA1 3ba5f6367d10c90ebef6a89ba569d5fedac36cad
SHA256 fcea128e56f79e8a0f140c72e5dcfd1d4176a87aeb974113949a32ae7e9da046
SHA512 3d477737f9a8e3dc9464750f68dbe848435cc2dc93f57e9419073de2fe268b4dda2af9ff5baa6695eb0d87c748035a5f26e7e4818a1f5b1e6be677aa4ff6d435

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f43521e859a920ad4e5d0d1e7ef6fc5f
SHA1 6d20f3f67bd02d31eecc4c49ef1109cf792bfe25
SHA256 1ae7a6cf448ac9da4ef0b68b4039084240fbb48d0e88f6169c798a71b7c4589d
SHA512 43f74150001bba3f3e2e2a3cb76ec2f1188dd0943abf60121ae62f5cca802af41e3ebfd3c2fd1e553e99c9bd96c8539f3e63f8504d150dad18149b25e2a57d1c

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240508-en

Max time kernel

118s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\bin\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-27 05:58

Reported

2024-06-27 06:03

Platform

win7-20240221-en

Max time kernel

118s

Max time network

126s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\download-chromedriver.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\electron-chromedriver\download-chromedriver.js

Network

N/A

Files

N/A