hxxps://www[.]mediafire[.]com/file/lq2c7h7vap2i4pu/SonyVegas16[.]zip

Analysis

max time kernel
146s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
09/07/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/lq2c7h7vap2i4pu/SonyVegas16.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
2776	msedge.exe
2776	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
3612	msedge.exe
3612	msedge.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4784	2776	msedge.exe	79
PID 2776 wrote to memory of 4784	2776	msedge.exe	79
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3232	2776	msedge.exe	80
PID 2776 wrote to memory of 3732	2776	msedge.exe	81
PID 2776 wrote to memory of 3732	2776	msedge.exe	81
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82
PID 2776 wrote to memory of 1552	2776	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/lq2c7h7vap2i4pu/SonyVegas16.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff473a3cb8,0x7fff473a3cc8,0x7fff473a3cd8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4216058812931235002,6498373292161171977,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe63f44aa3aa9393e4251b4b74226e3

SHA1
29eef15e4d60afed127861deebc7196e97d19e4a

SHA256
7787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3

SHA512
f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b0c53c5fe6ad2ee4ffbde1b3384d027

SHA1
0c9ae4f75a65ed95159b6eb75c3c7b48971f3e71

SHA256
2e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f

SHA512
29f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
afe6066aa769428c6f18ddfe6f864bc5

SHA1
12c39a62ca1893eb72e6c4cb39b49c8d479a05a8

SHA256
703dceaa00ed4534a0c5ee711f458a36954b0dcec1ae037829331823f2a4251a

SHA512
6110acf8bc5c91d35c22242e337413f659bc95a35490ad3e285af186fdc21819463996b335c783d761e756b01d47c7e6f255a26d4a0ae9ee45c00061d6df1714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c43e2cba583a7fd5de4b1e77767cfff2

SHA1
1196f626b26fc6051de30770e79126fab15a3664

SHA256
9225ea5e4b786174dc54fe15f0cecfae9d2e484095953110f8b5558fe2994fad

SHA512
d85d9dfeabd3708430e8f44f7fd338062a5d1cbfba28edfb7ac09806da0cddec606e9d6d198129c8a22b6d8252908b3c144331879ee526c0372ff5f6693f6f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b6651df5d8428708da4013e3ce86664

SHA1
e50db62648cd6e29345feba230206c4d8e82b07d

SHA256
dbb4eff26bc3813588c1058f10fa0259935a3499733e218f95df80b1d2d931d6

SHA512
aed3fcbad41d986e7906fcf902eb043432ee2056bc0b9096c6f1b974c6fd17ec77c39e08e7fe4af74785447f1349450828d0bf093f091487f4af12ba89346ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
17a6da28599f721d0d5f13cad8b4bc2e

SHA1
c6ec6750b6445173bcd5e5163eefcd7dee83db3b

SHA256
a025489aae2ebe029ca65f10ce46db15a2b8558b18256f13657fccb5f59d4e47

SHA512
73326377aec7576a3022c61d2734b46411d9a87c08aed81b27d80bbaac84d91f9af7d68dd0e01e471373b6ad346ba2759e50e90e6409920f1353d14bd1594db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4391a8e8ba84847f3d80b14fb869af5b

SHA1
ae0aa4de7467ec480399c37275ce422cc46c9a3d

SHA256
d2189f591634b87c6987cfaf7b55112a6a94227f9c5de54a74df4ddab9acba39

SHA512
edd5ec7836052606caa7bc266f487dcb2e920ba339ad0c05c9fafe371c73a973174fedbbfd5094acfbeb99fbedcedcfa1e17e741b78f16c6c925900834b57d94

Download Submit