Overview

overview

6

Static

static

1

URLScan

urlscan

https://github.com/u...

windows10-1703-x64

6

Analysis

  • max time kernel
    59s
  • max time network
    56s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-07-2024 04:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/user-attachments/files/16142209/Electron.zip

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://github.com/user-attachments/files/16142209/Electron.zip"
    1⤵
      PID:1416
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4112
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • NTFS ADS
      PID:3328
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2208
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2432
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:744
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:852
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1656
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Launcher.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Users\Admin\Desktop\compiler.exe
          compiler.exe config
          2⤵
            PID:4452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Launcher.bat" "
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4800
          • C:\Users\Admin\Desktop\compiler.exe
            compiler.exe config
            2⤵
              PID:4696
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:644

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF1CF77EB2049EC274.TMP
            Filesize

            24KB

            MD5

            d3cdb7663712ddb6ef5056c72fe69e86

            SHA1

            f08bf69934fb2b9ca0aba287c96abe145a69366c

            SHA256

            3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15

            SHA512

            c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\J0FC0ZG0\Electron[1].zip
            Filesize

            127KB

            MD5

            65840494599b1e99ffe8a295a35b5f77

            SHA1

            4c411680dc95f358fc17b32ff2840e1fad95c675

            SHA256

            527f74e250986a6d116f72b7183e5f2486bf317de47257330e6fd3dead1ac248

            SHA512

            49bc14720e745b822fcdc740cf49ba8a806d91705a317478f5254b505bd10c90df867112fc29cad2395a20456ab92f58cf18167533ceedb3d690f7ce8e2d4bee

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2NON8KYS.cookie
            Filesize

            167B

            MD5

            177c7b8141c38a374f41451e4fd2e61a

            SHA1

            c2d56083d26f881f67d135efb0e4913ae85056b6

            SHA256

            f93c77197588ac37d793944ae20113224fcfdd8bc8a1c2b89862188b5ee997a4

            SHA512

            182fcc795f39f3e924cb2b9246921a730a7137adeabb729cf8f551ea4a37c38ca8f3dcd3a59d682b767991a6df4b3bc949d08c31f547ddc4dae7361cf49034b7

            Download Submit

          • C:\Users\Admin\Downloads\Electron.zip.7vgt337.partial
            Filesize

            437KB

            MD5

            e7dfe83df5e033be8973d53adb5e6699

            SHA1

            c66de42000afc3d259228500c2da5e077ab7c0b8

            SHA256

            e9cb639a1b1360aaad932800ae0977c20302728d2565500908be859894cdbe5d

            SHA512

            de0c9ac2c97e7badc4fce340e35db696174faaaff8631177882c4de360ed2c23d8084d7db04548eb3f085f3af6005b31066228c6b1c973e573fb901e4190261e

            Download Submit

          • memory/744-74-0x000001E6C0190000-0x000001E6C0192000-memory.dmp

            Filesize

            8KB

            Download

          • memory/744-69-0x000001E6C0140000-0x000001E6C0142000-memory.dmp

            Filesize

            8KB

            Download

          • memory/744-72-0x000001E6C0170000-0x000001E6C0172000-memory.dmp

            Filesize

            8KB

            Download

          • memory/852-87-0x0000022848B00000-0x0000022848C00000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4112-35-0x000001A4EC9D0000-0x000001A4EC9D2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/4112-16-0x000001A4EF620000-0x000001A4EF630000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4112-0-0x000001A4EF520000-0x000001A4EF530000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4112-123-0x000001A4F38D0000-0x000001A4F38D2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/4112-126-0x000001A4EE6E0000-0x000001A4EE6E1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4112-130-0x000001A4EC9C0000-0x000001A4EC9C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4452-149-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-144-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-142-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-148-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-147-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-150-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-152-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-151-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-146-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-145-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-143-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-141-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-140-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-139-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-138-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-137-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-136-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-135-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-134-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4452-133-0x000000007EDF0000-0x000000007EE00000-memory.dmp

            Filesize

            64KB

            Download