hxxps://www[.]mediafire[.]com/file/5atrjxgdf869gjt/PrsPls_ByDerek107[.]rar/file

Analysis

max time kernel
480s
max time network
591s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22-07-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/5atrjxgdf869gjt/PrsPls_ByDerek107.rar/file

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
1728	msedge.exe
1728	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4316	1728	msedge.exe	79
PID 1728 wrote to memory of 4316	1728	msedge.exe	79
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 1512	1728	msedge.exe	80
PID 1728 wrote to memory of 2124	1728	msedge.exe	81
PID 1728 wrote to memory of 2124	1728	msedge.exe	81
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82
PID 1728 wrote to memory of 2156	1728	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/5atrjxgdf869gjt/PrsPls_ByDerek107.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa41e13cb8,0x7ffa41e13cc8,0x7ffa41e13cd8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18346563352266355307,4021509457261026003,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe63f44aa3aa9393e4251b4b74226e3

SHA1
29eef15e4d60afed127861deebc7196e97d19e4a

SHA256
7787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3

SHA512
f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b0c53c5fe6ad2ee4ffbde1b3384d027

SHA1
0c9ae4f75a65ed95159b6eb75c3c7b48971f3e71

SHA256
2e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f

SHA512
29f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
ee63d3775323269c09cca58b00966d1e

SHA1
a38a2df2eb69e093ab1ecf94aa53e2137dbb4f5a

SHA256
74e9b17bd0b935d164d940693db47064fdc60ace986f69b8a237a2dcc4981372

SHA512
1f4208681571315ccde393fb9d6aecc13040a1c86df4950c11cc2b899448be7230e8a4b4d285807fa4fee73889c823dcfc932b54461ebcfe3f0edff2528b9127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6721fc9fa192b57d73328efbc0ecf5ba

SHA1
a371fb37a091061638a304e1c9d623154871582c

SHA256
4989c830fbe72716e0656238509577ad0ff48f4c500f881866939adb6642031b

SHA512
c088402f743d558c833efbc660b8dda384e27b156a5a3e27c054fdfa4c95420ca8f63dbbddc0ed7b345c2f8a296e437cf003c9a48871aa292e10ea263751b40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
341e4dac8bf60234d461d2d3dd8db84c

SHA1
3bdf39fa001a7c8dcb7411458a97a2746a29f473

SHA256
d49c883e0f640b2d01819c936317eaef70d6e930759110d458a65d3e48f023b2

SHA512
be7639d8033efbe069aed0862d82adaebb7db19d71bfd8dbe15026f54fe12bbbce19b52b8f29acf22a8b198190eaa758042b220b88bc774f34ede4d6e8387db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7d3b32da7f2156f933dabd41e98da1ff

SHA1
6f57564885e48d3d37e6e962d65201669110f75e

SHA256
51146a32f561ef2455254e3e700189cc1256f58a28fa9b8f38b819e0cf5fe86a

SHA512
70fb071ec404bad0b0f7b7aa48afbb3c03738c7bcd1d9609fd9f00115dec164817b76c9e46bb43993e0177ccb7a951641d0a962a14fe51954f0522c170e6f045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6634fabf39383ce74fb203c35ed19bc9

SHA1
5b8e133047e8d4b433109c28fe5e56e9afcd21fe

SHA256
9a627c93063ab6ebc397895960d701f86f24351cf1406c2b0aaf06e665b7cc2b

SHA512
a54b6355db79c7edc58989f0bb886dc82248c5e7f51323927c5d496353ff384d752c5640b1c9e3dc329a943ededa76dc0fcf34560e35ff893e997f161a909bae

Download Submit