Analysis
-
max time kernel
76s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 20:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1259918121221750876/1260325162419753123/Electron_Crack.zip?ex=668ee8c6&is=668d9746&hm=8bb6579e61c2334fb42eb33c2c0bd8bf682f044aac9c9437cb86b7cca433d1ac&
Resource
win10v2004-20240709-en
General
-
Target
https://cdn.discordapp.com/attachments/1259918121221750876/1260325162419753123/Electron_Crack.zip?ex=668ee8c6&is=668d9746&hm=8bb6579e61c2334fb42eb33c2c0bd8bf682f044aac9c9437cb86b7cca433d1ac&
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1188 msedge.exe 1188 msedge.exe 1580 msedge.exe 1580 msedge.exe 1280 identity_helper.exe 1280 identity_helper.exe 3656 msedge.exe 3656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 464 1580 msedge.exe 84 PID 1580 wrote to memory of 464 1580 msedge.exe 84 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1572 1580 msedge.exe 85 PID 1580 wrote to memory of 1188 1580 msedge.exe 86 PID 1580 wrote to memory of 1188 1580 msedge.exe 86 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87 PID 1580 wrote to memory of 3080 1580 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1259918121221750876/1260325162419753123/Electron_Crack.zip?ex=668ee8c6&is=668d9746&hm=8bb6579e61c2334fb42eb33c2c0bd8bf682f044aac9c9437cb86b7cca433d1ac&1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd218946f8,0x7ffd21894708,0x7ffd218947182⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3508 /prefetch:82⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6601634912460072653,12748983555245959603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:4456
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4088
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Electron Crack\Electron Crack\READ ME.txt1⤵PID:1044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
186B
MD5859cf9cd77c9a6bd5b0af56f08fb5128
SHA1d62387a78e8a1643ba3117187479da14bce1b65c
SHA256d16c0bd72e9deb73d2e3a40eb21ac668477363c33e58765884b1663324a4eb05
SHA512e60f5d7000507794a20316c7110fbee3f1d9b02efdba877bec150d5d63939eff3aa9fbba758709a8094c65a083b158840563a8e8399b64e16a077d12a1cb8fed
-
Filesize
6KB
MD5f44b5dcfac731c06cc1a2c7a620a78c3
SHA1af80e05886c30223493c14687a85285251f425be
SHA256f2cc64c451369a55f3c6d9a410104b306e7f2f813cc2cc550c1facaafc74f69d
SHA5122440d1fd908954242edf355695b2dcab059dfbf9f480bb8a4a0fb3fc35c228d3b2357bd69eeb83e21ae08627bbf1255b2ee69bc811af56fff64810570ebb0bd5
-
Filesize
6KB
MD5457baaa78ea5b33aa46637b01507328c
SHA18178e7a7b07e404264c98407f56e41da9568d8b2
SHA256248450feba3679a4997f6d9c841c2b696385df7342270a1bf107e20d48363cd0
SHA512d85031e9b0f97847791c1874037bf8ff1d883af7f8a1055d09a2514ce47e050eaa03362f8b3dff6db04ac771683b22be25dcd6ec36cd7e974dbc34a97e529edc
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD50d77cf7afa6c5d93a111ad84893c1827
SHA168bc2574337fabc0b5ee7c95ecfd56f11bded6ae
SHA2563e3bc784d44e933eb9c626df62049dcf893d56962e8f06f3b3190bb24ee6a577
SHA512f9d9ce968d075c0f13a60701d7aa3acad34b867b9fd0d610a7f1e11904333f60501f2dfa48312b5fea3c5853dcfb819e58de99a8dc6978329b11afcec90aac6b
-
Filesize
11KB
MD5f5bbbc2113aba0d37ce3d8f651198a47
SHA1ee84725cc6cd908a7f7d58c00786ab4ebf56b078
SHA25688b5d251cbd95e3243d3aa0c10cbcb92d08a091924d2eb0e362e829ef99b54e3
SHA512db774bf3c61530a4b9a4a942f9cfdda45c9d16d4f7466dba3a031a7ad3c5a9bcd6eb2fe241f0b23a78df0b3d2f5effded83744cdfc3dbf6a1196c86bf4c55b30
-
Filesize
24KB
MD5bf7f92a907d75c411ade220f84392ce8
SHA1ae0695c76749a46d50ccef349be178f0c6080fe2
SHA2562ce1b01108455cb7e11be8a7293c902698f88e8983cca4f42e13285fc851f9e9
SHA51291ac917e3fdf274667e9770abbc49839359f90ae9eab8da200088794c560ef7e79933acf01ade134094fa5651566d43652577fa57c478e025b5d1d1d6dd18a6f