hxxps://github[.]com/pankoza2-pl/malware/blob/main/PanKozaDestructive[.]zip

Resubmissions

19/07/2024, 17:15

240719-vs1kea1flq 1

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
19/07/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malware/blob/main/PanKozaDestructive.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
332	msedge.exe
332	msedge.exe
1592	msedge.exe
1592	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
1624	msedge.exe
1624	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2744	1592	msedge.exe	81
PID 1592 wrote to memory of 2744	1592	msedge.exe	81
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 1036	1592	msedge.exe	82
PID 1592 wrote to memory of 332	1592	msedge.exe	83
PID 1592 wrote to memory of 332	1592	msedge.exe	83
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84
PID 1592 wrote to memory of 236	1592	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/malware/blob/main/PanKozaDestructive.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc72f33cb8,0x7ffc72f33cc8,0x7ffc72f33cd8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,17426692814454758550,17359437200796428696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1ff2a88b65e524450bf7c721960d7db

SHA1
382c798fcd7782c424d93262d79e625fcb5f84aa

SHA256
2d12365f3666f6e398456f0c441317bc8ad3e7b089feacc14756e2ae87379409

SHA512
f19c08edf1416435a7628064d85f89c643c248d0979ece629b882f600956f0d8cd93efbe253fa3ec61ad205233a8804807600f845e53e5ed8949290b80fe42d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
562b59fd3a3527ef4e850775b15d0836

SHA1
ffd14d901f78138fc2eece97c5e258b251bc6752

SHA256
0a64863cb40f9d3b13a7b768b62e8b4707dfee1d3e86a07e999acb87bd7d3430

SHA512
ef9fd3d83ab85b18cf0e0d17e2c7d71936f783e3ae38005e5c78742560332f88be7c4c936d4dc4179e93fde0240d2882d71ef7038289c8cbddbfc4790c0603c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ffa8d7fde4987f96599e8c72e3483ef0

SHA1
36f565bf33edcc8b0a3dcdcb842a8129c2e1cf84

SHA256
d67075db42d4847524d4cfa232212a02ac2370192b06111d096c09ddd264dfda

SHA512
6283c216dcc49fc8a65a36e33b702e917c2a4a3ece3a34a7c4122ad5affd18ecced196bc43ccceb1d83d2a620e583a29c16ee2d98977635fb683c6b69244fa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
8194ed25dbd9488193ea0891ba2a1d61

SHA1
1602608cba6eb29c098a3cc75373719ff803b46d

SHA256
f8061a62c10c0c68205a93c4797fc675334a13bdd4bcd3e4dfbcdf67293060e4

SHA512
2882eef26bfaefffc3d268b418ff128422b2e9055f6fc560b1146bb121e39926e83cf04ea5c648425e2906c37a5a695447fbb4ce3ff2cef7a8aaf25421fef995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c78216372d2e2f3a7828baba76965d07

SHA1
654556f2b2481284e7d28de6cf2dca1776a31ffb

SHA256
c39a90a02f39b1c5e96fdfa0e9c8f41294891525c1a9b46da1b58a0113f8cd96

SHA512
16840ac400fb25bddeff6d6d73d887dde5e3467c9c277d9cac357878a5d958ee2b6b1afdf724368ffd49e18dd5d0d59d211543c38e2b9092cfd50f71eb2d1211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0968fd4aa1f95508b3cd561379c81a76

SHA1
4a478ec9d8c48ae00b199a6a98fdb735568c9827

SHA256
e119312fb4817e26ccdc50d5ecc20db000fa303a08f31de37be2cec5c933aa60

SHA512
ecd03037c0e1101d9cd6b8522871fb7e33fc30f694b2e678b1f1e17a93c6f7c24d70461133b52c11ebbfdf15ba49ea1f53d5d96327ce1f16bf46e7a4a93746e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f7d191b91af61894eff2fa1870f5788a

SHA1
6d038d1e863b9de444f4704c37be1e0d66839750

SHA256
28266a36370b132bc3581f830510964f3015fc27e2757113581061cf625d12f1

SHA512
faee58af60b01e49af0722e3734e00f7d3566cce7b0887c239402cba37cf42cf2059526b6f0a4bb01f97f1a5419fb01397177e3a95ff8207fed2cd1bcf96faed

Download Submit