a08052b61ad409f6fa93f21e2888980a23a154d11ab400f37ca2f42d33c2c8cd

General

Target

_1024社區（PC&安卓）發布器綜合包2024版/_扫码直达1024社区.html
Size

375KB
MD5

ef0a7aee719842f4c90981cfbc62b2c7
SHA1

2d9297e9456565123de87ba12d079ba62d5f01a3
SHA256

7ba711605626548410f25a24fa5b356a9fe98858e1030b09226db6f291aec23c
SHA512

d28a271abaf7f38223bfd729d458e68bb5c0f75a7e9a17b79313eea100139a298e90cbb2ddae20ebce5035e4ded02a9ea12139e0b25900f0d2b6142911b6eb15
SSDEEP

192:na+Xa+zaE/7w6rGrzrirSr6+DKAKZQaWy5Cx+vxkcxbjEva+Ea+a:BRTw6KfuGW+roRm8a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2788	msedge.exe
2788	msedge.exe
848	msedge.exe
848	msedge.exe
1212	identity_helper.exe
1212	identity_helper.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

848 msedge.exe
848 msedge.exe
848 msedge.exe
848 msedge.exe
848 msedge.exe
848 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 848 wrote to memory of 1756	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1756	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4576	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2788	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2788	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 2516	848	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\_1024社區（PC&安卓）發布器綜合包2024版\_扫码直达1024社区.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8291c46f8,0x7ff8291c4708,0x7ff8291c4718
2⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1898853327923557651,17074322671953078580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
73c7269b2d92ceeef29c5b03fb1f46f7

SHA1
6efafe5bcc30dda9add365d935cf979ca157e9c5

SHA256
6d746b7b0c86715052119341c7317c660f7f97505544bdda9d81ca99f643174e

SHA512
b155125555170a9801f1e5669d698e214b07b01ba96554e44e13eb9c51fad9448915188e6d15bf59861e513577a2369f9af37fb2dd0b35956323575e2917dd3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e7ff75e1f60b7c3bfc30840342b47b03

SHA1
d0b4b64655ff12109219d96e35963611dd245979

SHA256
38f08a9bd68330e8916630a891ffa749600d3332f7588a17630641499c2ce738

SHA512
112390b2971704bfe21d53e9194b349ccd809052a1d0c0595819541010ec25c08e5d940808a2d2d6b4f57007064e727601f8c155ee4c3fdda52ef1d2201eb416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6103f83ca8c3cb6e3461c952ca91fd9f

SHA1
f72881e6136d39bb50a7898aa39b4569c8d774b5

SHA256
8e5596e4077ef5f3532d2d0d6d1fb9f4d0f8265da71af3698ae73b3d7c21c1aa

SHA512
5f34db89b99496ffa03eec7637409c9b92281b084344699315d87f9db1853ffe5c471ece7960ee36ccc660aa7fa8f6092c96f591efde44dad85e4c7038e87134

Download Submit
\??\pipe\LOCAL\crashpad_848_MDETWTXJPHPYXGUR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads