hxxps://github[.]com/nguyenhoanggiabao98/Hydra-Virus/blob/master/Hydra[.]exe

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/nguyenhoanggiabao98/Hydra-Virus/blob/master/Hydra.exe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
4548	msedge.exe
4548	msedge.exe
2128	identity_helper.exe
2128	identity_helper.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1816	4548	msedge.exe	81
PID 4548 wrote to memory of 1816	4548	msedge.exe	81
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 2408	4548	msedge.exe	84
PID 4548 wrote to memory of 1584	4548	msedge.exe	85
PID 4548 wrote to memory of 1584	4548	msedge.exe	85
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86
PID 4548 wrote to memory of 1672	4548	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/nguyenhoanggiabao98/Hydra-Virus/blob/master/Hydra.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91f8546f8,0x7ff91f854708,0x7ff91f854718
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14574141820825713841,17364822067859671978,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f9e355405fe9de813536a2b0fc3dae86

SHA1
43f97664f40f62d22b27b1681f6d52756e66d4ce

SHA256
ec555ec9154d019b7eab0068b3706ed65af65d2f52f0beef2f4f3db0eb3ce7d2

SHA512
46b359fbc4b13b746fdfff9c2cc66fdaeca215495d832a8954f7d3da34e0fb8cba18b657991e752123dce81dae587ec69ae6a77dd811f289f8fa5530d961aae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f920fb04c0f7652e3c5c1cf0c019baf

SHA1
cda9de93725d86ec30b4b11df0f012e0777486b7

SHA256
921f66cc901d49bf2f623b17f85a4d0f0593f162c1f2e73c50f5ef86c7e4a372

SHA512
aa3780270484e2313adb87650c4afc862d134dfd784ba533e2157f04ff7f59ae2bcd2ccb86a1662d2ab423c9b583c39b2fcde362b4283a08041a48d633d0f409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c88a21b4104429f959e14bf83a168076

SHA1
5d3d88cccda2f3240f94b7ffa68bbd6b675ea4e3

SHA256
2b91281627fe73bec6d2651af4a052f69b3fa43731a41ecd0a6cfedd76b7c0ce

SHA512
fee26c1ce3c82b64711a9c41d4de6f69bf2dcbfc9ebe912caeddace9f0c50d680e8ab407edcfae71ce09fd3f38e79b62b6e5f33b3061db8ddc258475ada10610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a51c390a2877f3928488ad343e8c85aa

SHA1
b5cfd6e504fd990ee0906ec784027b3eef5f85d0

SHA256
b6b1af4ac044ca0fdaf5eeabbef42c7f13b57b24d5ff2b1f867dd593922caf23

SHA512
2add69b249043be02a5d18299138db5bd39f668ad246232d5e767bb626899f32dfe58347748bdf914aa9b058da2ab45f3849a4f91d78909f4abe79c3eccc2af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
848ec8d9d4541476b70eb51be51f52e2

SHA1
f46e006efa1aa710adfa3c1409564d77e55677b3

SHA256
87a5220e2bbdfdca008383973e1dad1832dc1347ce8b535429b0daff6309878a

SHA512
92c4d0aaabec225575c9c1c15d603c36492bd160db2db8a424b38952a21c88c8ea5e599f3748eb590d0bb32f349dddaa343403e294c6020d09be09258a8f88b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
894b5cff59f7a28a51fcd32dd842bc29

SHA1
36a832d787f3a0cb49bc5a7043d1d1b0ac65c913

SHA256
551272d618c0b89f97747c37bb313d449216dc6a888940c94c887f9201a9a732

SHA512
86c0035792125a707aa54435028d5fe2008414ae69bb4650a7cc013b2bdb9e297f8d5173255b4ccf67cad64d281b9aa314af28effdced18db760e03fae0a902c

Download Submit