Resubmissions

01-07-2024 13:03

240701-qarsbsshpc 5

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 13:03

General

  • Target

    {SWIFT RECEIPTS_Caldic.html

  • Size

    29KB

  • MD5

    5880dac6959c489ddf64635b20c92cc0

  • SHA1

    c553c616ad41049aa6e08af74142719adb9b2658

  • SHA256

    8da9e04dbf8e10729979c4c801cf3083b9863041f913949074759929c198d4a4

  • SHA512

    9d6fa4c93421bbc94e8fcbdd419ec8411fe427f0a4915498f5e83629a47f71fea27e8578df1e1e4a39eea272cb7415248136408bb0ceb840d2567b34a3311a69

  • SSDEEP

    384:8fAqgfAtRyXggRttFDgVp8EFTuWdp7fWq9Roh9oQ/2aB+WpN399ekKHDBOWXPaCy:AgfAbKrDgX1TEq9RYOGpN399Aj/1jfe

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\{SWIFT RECEIPTS_Caldic.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e84718
      2⤵
        PID:1644
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
        2⤵
          PID:1224
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
          2⤵
            PID:2084
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
            2⤵
              PID:4192
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:756
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                2⤵
                  PID:2908
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
                  2⤵
                    PID:2312
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1288
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                    2⤵
                      PID:2708
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
                      2⤵
                        PID:4104
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
                        2⤵
                          PID:5012
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                          2⤵
                            PID:3836
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                            2⤵
                              PID:1884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                              2⤵
                                PID:4996
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14264853071448790,735806553475444845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5012
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3976
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4820

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  a8e767fd33edd97d306efb6905f93252

                                  SHA1

                                  a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                                  SHA256

                                  c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                                  SHA512

                                  07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  439b5e04ca18c7fb02cf406e6eb24167

                                  SHA1

                                  e0c5bb6216903934726e3570b7d63295b9d28987

                                  SHA256

                                  247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                                  SHA512

                                  d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  264B

                                  MD5

                                  57700ec6bc50a191c90e1945d8ab231a

                                  SHA1

                                  6747c64768edddaaf5d349141042048a39eafdb5

                                  SHA256

                                  c7acd0b838fd8056e8914a222e4fd337f272d363643bdcff45d42eae5f632a3b

                                  SHA512

                                  9786446b46bf4b3bfaeb3adb3a334d672ea92be0cb82ea6eed28b071edd713d71d1973f3a83a10c1796d97e36c3fc50fa0c9814b3aacf850d7a375b0b1803eda

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  192B

                                  MD5

                                  ed5c974545791fd164485f06c3bdbab3

                                  SHA1

                                  67cafbb07e3e11365af9db6f4c0426cb5bb35515

                                  SHA256

                                  22031816b605f6162e76ba0d4dc290bbbc6b43ff2ab2fb4e38b9c45996ab13db

                                  SHA512

                                  5c6d5c48234ec4cd8e8c6e8b07056619b2340085298b3869b60755ca3f6af4acb4ce78338dfca2e495c6d6690b949e59d7a4136804414f9496797f843af0314c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  0f67f6ffe9f241ab47694812f49151e6

                                  SHA1

                                  5566ba6775c9db5289529f2e7ec2159c29c4965b

                                  SHA256

                                  4623eaf1c290b33c07e53714e8fae61f278bd90c08e9c02d3d15ca75a76507dd

                                  SHA512

                                  1ebeee9fee7e341c4f0efd53b843fcde64b7072b3e7cc68df523b562a149955f2123aebf24df9c77b31d2757fe51ee8c964232efc8bb896a6913bd6e139d34da

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  a80026225b1928e37ce3a6733017221b

                                  SHA1

                                  358de365d9605d341aaf8288a0aa529e27247407

                                  SHA256

                                  295f4006c4cd4b37d5d6671238ca34d9fde39e5ea0974635385664dc810cd005

                                  SHA512

                                  2e1a0c5753f2846fe26e6ed00ebf66de97e87e46d4f9d5ceed3a72d6e5528d736f422d37796f91a05ae31eb48463b7087eea7c5b0a07cfe71f468d318ffe8665

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  d10bfab5de2da4b86d3cc25d088ad796

                                  SHA1

                                  5552ebf341bdc0867293d2276243f006b1e28d9d

                                  SHA256

                                  c574535c1466af22340fe4260aef0aa531045fd352205865a6bb6ff04b531508

                                  SHA512

                                  f812b5be49d729cf34e260bc8746dab12c6fd3ca0b8f66edd80fec91ce8694df48ce2bbc3f9b041d8dfeca1016e7ba7c8130417b653482f18985d65ea4a0d83e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  734f80d3d59b9ad1699a3b0b2b240c51

                                  SHA1

                                  6aa762c70c353a8be46a38c0017126dfd7907f28

                                  SHA256

                                  e577b20d1fe25990b42e63af4f3850feae38058fc2addbb14da2075e6c7a59ec

                                  SHA512

                                  6e436c09e438168d90215fdbeaa9e62a3b52161e67c1f7c39512480bcf50859430429a6aee3541dea400315bd6eede8cae787a6737a1425bc27c4d86c5d510f9

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  b97de64ee3b11d35c35a191c4d7168b3

                                  SHA1

                                  d179ebbcef2640247a48b00e6c3231dcbf87794a

                                  SHA256

                                  276d9fd0b727ff2c2f274e6c3bcfbff5afe50505783ce706cf7725fa923d28e7

                                  SHA512

                                  d99b80b43ac1272035dcb32c63880c87c67ea7610444d6266ece3ac3feae5a50984bbe3ac9722418717cca926a7a4315dca0f77400dc3800b909532a7a3cd339

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  871B

                                  MD5

                                  6871bed0e776793cf441dfe15e078fa5

                                  SHA1

                                  a5b857a7a200c5abaaae95e127fee44681cf05ba

                                  SHA256

                                  7f033ef40ed479bccea8a2d20edd10490bfdd900bfe5576b089098081d1d6ee0

                                  SHA512

                                  aa02bb43a55b6f044a9865c13c5bc40842729190e7ce68118d72c1f4a05e5a50946ca3543dd8806349101fa050d6d135045ee6bca29247930a9f666d8b8321d5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  871B

                                  MD5

                                  f4add9e2f145882ac67aedb2205db171

                                  SHA1

                                  713743c168f06fa5faab057a5f51b5206cbf9baa

                                  SHA256

                                  973147f8d07b8f81768c16916f6896e1d34bfa971d26181027ca086517af6a0c

                                  SHA512

                                  c6696256e368b3ec033b2b989e7e3b9b2ea6facd90fc329db524e6dec60322bcdab9efa0761c0c95cc0c2590e0d8838801474042bbfc19d492e5b034811bbaf6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f28e.TMP

                                  Filesize

                                  871B

                                  MD5

                                  5111d80d49fa5e8d72faf9a4cdb3e282

                                  SHA1

                                  7fca3f2e62f6ca421d3ca0cfb1ffc8dd8fcd6a60

                                  SHA256

                                  42bd47f820a74b7c0a26351142ec5260c296e5a19c55544ec217c4bb6c9e0c9a

                                  SHA512

                                  692e5dce6ce8e0c96c16d849f1ace07c799d3bed7dc4982500c944ec679abcb06ca5c8ba0660c2decba38e9342e95dac05a82c186e2280fa3d7fe3649835eafe

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  550c805e80fefb3d59f389bec5585478

                                  SHA1

                                  46e7e0e7bc5e08adcd1f3c8dadd7b1d45297e411

                                  SHA256

                                  f6170cbf8e6825b318797426d290db724b46850f827b2c5808c5759a12a083e9

                                  SHA512

                                  4f51e52b1c6f0b98afa78a180f258e440b86835b0e0badd78f3247c077ab2ce4d8fd5867e7767fc76b24a2f7eebb27df227a7beccdd7ddbfbe94c9cbdc0cc0b3

                                • \??\pipe\LOCAL\crashpad_5108_MCQNZSEUMNRWYCVX

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e