hxxp://www[.]tightvnc[.]com

Resubmissions

29/06/2024, 09:05

240629-k2k6zaxdrl 7

29/06/2024, 08:34

240629-kgnflaxbrr 7

29/06/2024, 08:28

240629-kc48jstgka 1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.tightvnc.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
3464	msedge.exe
3464	msedge.exe
4484	identity_helper.exe
4484	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1836	3464	msedge.exe	82
PID 3464 wrote to memory of 1836	3464	msedge.exe	82
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 1500	3464	msedge.exe	83
PID 3464 wrote to memory of 4360	3464	msedge.exe	84
PID 3464 wrote to memory of 4360	3464	msedge.exe	84
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85
PID 3464 wrote to memory of 4868	3464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.tightvnc.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb3746f8,0x7ffcfb374708,0x7ffcfb374718
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3010227903043471855,1942350545796131894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3ee17d7dac375e2cd82758c989317ab1

SHA1
5c4f6e6f52d24ee58f8dd5ce773364ff2a640818

SHA256
d3022f5277f540cb0f595913750b8620b219686be87c42dc914b229dbe7bc2b2

SHA512
47a78affd8e8139d3aa9a4e4677dd411d4b0fadec55a17cc3be49a05b68826cc608a38ba49b569cf17ec1dfe41adf473cadb3db8ce2c8ddc39fb5f826446a2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
270ac00f0836e681ace73ef66c3b28f3

SHA1
5b12557d79009573ce00308c158b7b5a5197411b

SHA256
3ccbe209e10bd15059deb12a68f422e475bc2dafb9b00e397e8a9e339c43b742

SHA512
83897b8590b37d0152e4bdcd316bdf1e0b839dc559203cb157752b0cd80cdc614806ecce8e4cb3be4561d2ca67f5d314297f8faf913d6c10ec67c14b9508acfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5db375116b14f73957f968814abef16

SHA1
0eb813a3ecaaebd5db22eab114f54db34f5c43eb

SHA256
c0b53a0253bd1a50cb68f19f6bd9376ec6aa4367a9f2006c56f859d9d4a10285

SHA512
40ef7dfb786012fc9680e56faeebc40dc0a44b9adce2bbe3fdc4bbc31d8058d0f46e0fb117c97ba01f25abcc28ce8e77c8a72cc53b4f096f0f653f6dae3ca82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44acc513b6617816deb9585f49a75d23

SHA1
6c88f41ab6ef11a66143f4ba91fc22df948fad62

SHA256
ce5b9e806858c1ef5c16dcb0df34ea7746c2bb4753508447f6449fd83e79d061

SHA512
9141ec2f5f591dec36ff126e5a657da1307ccfebfd70c7415d6805737db088a695b01d938031c7e0f09b5dae2aa8aca12a13ef18766a4b3e4173e0a2bb01392d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d6f56ebcf50e71d00b4dd64ebf989f8

SHA1
cb89c80451b5cd3d670dd7ef28d90ae6521732ea

SHA256
aa7f8b23716a78f43530f44a34b806cbb78676962a5acf58b6ce543c738b05ea

SHA512
f40551a39157cba22008d749df5c5d07cf1f30659ce23340806861cad77cd72899f28970950565dd7419ed930fb573ac26118ca0a2ce5633d275f16399f085b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27b1190e362fc3ddc7a281128a530095

SHA1
14da634ff06ea56dc31adbf7ad1466fae502bea3

SHA256
afa5ee103838651c9ddd084f8067efce3cb0214582a94705568b2ac821eb3335

SHA512
0e71835fb1ffa907bf2f4b417ff2c8a9f1054c9f60e6e5a631b0755db91d9de4d0d6040f9a41771f326635b9f47702717bd41b920c3c2bd66d93dac6a74bb488

Download Submit