320c2bf617ca46f8b48ac1ed5e2e3edf11b89c6c3b9429bbc630a47ad65c73ca

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PROGRAMFILES/Dokan/DokanLibrary/README.url
Size

147B
MD5

d73e2ea707a98bce24b1970c91d82f6c
SHA1

958c538cbf96d06dd81f014fe4ac0c90137c5d40
SHA256

64bdc2e022158e93eefb2f1473f419ae9f135bc193a846300d95be39a0a4237d
SHA512

0201be70496c4961219b5063c95461dba01e03961e1aa3170518de615c1337551c2fc78b3e957817e534d431e0c71781492967688b3ee95ab3ab664f6ee9a658

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
24	camo.githubusercontent.com
25	camo.githubusercontent.com
19	camo.githubusercontent.com
20	camo.githubusercontent.com
21	camo.githubusercontent.com
22	camo.githubusercontent.com
23	camo.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
4068	msedge.exe
4068	msedge.exe
2328	identity_helper.exe
2328	identity_helper.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4068	1492	rundll32.exe	83
PID 1492 wrote to memory of 4068	1492	rundll32.exe	83
PID 4068 wrote to memory of 4464	4068	msedge.exe	85
PID 4068 wrote to memory of 4464	4068	msedge.exe	85
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 4944	4068	msedge.exe	87
PID 4068 wrote to memory of 532	4068	msedge.exe	88
PID 4068 wrote to memory of 532	4068	msedge.exe	88
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89
PID 4068 wrote to memory of 1012	4068	msedge.exe	89

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Dokan\DokanLibrary\README.url
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/dokan-dev/dokany/blob/master/README.md
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7ff9ab9946f8,0x7ff9ab994708,0x7ff9ab994718
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16067397944526915576,8620741417664793526,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6c11a2e74ef272858b9bcac8f5ebf97

SHA1
2a06945314ebaa78f3ede1ff2b79f7357c3cb36b

SHA256
f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777

SHA512
d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bf2fae7a6a17a558e38c1c786005ac3e

SHA1
4cc29118edb1ab7998248f1dbbe5f793b1970e40

SHA256
ee2cbab92e5390e7bc495812989a8e112d6bd72ca94baba97b49ee6d95434dab

SHA512
4de607ecf41a451ecd1bc87a387d46ad63720cdcb6f6cab7aef2c734aea3a11ec1790277418c7b218ed7c5bc3249855b90284b96f061978e479ee398abf2d647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
f41567987ed25b1e7255e9fd9f4ccc49

SHA1
80dd0ffa5b7f7afdf7fd01e41ce5da5aa2a36213

SHA256
194c2b6dea9e3ce80f3bf32b9a317d8a28b9eb997255d65cb703158587b6b1f2

SHA512
05d12831e3cb8db4196a7a44c871216ea17448fe6c590fc6e275dbaf5648f0a44da4c456a9d891aaccaa16163a20a9f89a40d996b91d75112ebc4aa0f40e649b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e7756bf0d5691b33805fb8e0fd1709d

SHA1
2996d1479f1d2344fa5ff2ca3f1225dd020abbb3

SHA256
b70e4a3ad597683a2b4f8022e432e677c6afc3b497a1d055a5a715e038e28897

SHA512
c4aa2e40b812ceb3655b0565a942a22ab30471ae9766fd3167517236e0a533463688afa56a23c8d07d6a9c9450e6cf934652bb261e005b5f6264997adfee3213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2073ca96fa788197c933443f5f81e21

SHA1
27eec0a576beba540e17dcf94105d028faac9d90

SHA256
515eda25c327ffe91a29f1dac82bdea106004eb531d515868a9a8d172dbd9ff5

SHA512
5dec57967b26c7d4bbbe05ef039b1e2d14caab89edb5359c0703569fbda38c5f32404374fe7110ee21d8c8d79648e8b925ab8d2779b3e8b91ce5ebbdf9a43bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6029f0ca8427408da228d2511b296659

SHA1
c7cf9f2eeeb87f2beb3eefe0a9ed537e2d72d256

SHA256
c9de38beb6de0b08cb30312ff16752a0e57b8bee75469ffefde459721a183637

SHA512
45afc1a51417a9dea5bb25749f3ceb8abb6d0f12d2781a47b27a0fc5d0fbd92d6644fedf96ee889121118e6919b4b4ae9c72a5d8620b4c81f28e611c1076ef4b

Download Submit