49534e847f24fdd727ada248666c5ebbbf7cefff54443df1dd56240cccb50a97

Resubmissions

02/08/2024, 15:17

240802-spa48syhnr 3

02/08/2024, 15:16

02/08/2024, 15:12

02/08/2024, 15:09

02/08/2024, 15:06

02/08/2024, 14:51

Analysis

max time kernel
95s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TALKIT.exe
Size

534KB
MD5

bbc3687e84989e3f70f2179ba9a458b3
SHA1

7059147afcd22233c1180fa386414b8e9f8bc10c
SHA256

49534e847f24fdd727ada248666c5ebbbf7cefff54443df1dd56240cccb50a97
SHA512

e66f6881fb5e3f4a7911fd8edfae82f88d4c4089eab2efb180fbc5c0860edd298c85d838426e0ba4cec0d392ae76c470fcb442b9699c841d5919e008e5a5fac5
SSDEEP

12288:Hjv3p0iAiC7vbJPnZRJ49YwnX4P5g2OVs/wZfdjWPb/h9BiyLtNd:HdsNd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TALKIT.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1588	1264	msedge.exe	105
PID 1264 wrote to memory of 1588	1264	msedge.exe	105
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 2960	1264	msedge.exe	106
PID 1264 wrote to memory of 3556	1264	msedge.exe	107
PID 1264 wrote to memory of 3556	1264	msedge.exe	107
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108
PID 1264 wrote to memory of 3688	1264	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\TALKIT.exe
"C:\Users\Admin\AppData\Local\Temp\TALKIT.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault47ecd257hfc73h4bf8hb5e0h58481d5a0622
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb434546f8,0x7ffb43454708,0x7ffb43454718
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,4809180014252519569,7151724932369623030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,4809180014252519569,7151724932369623030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,4809180014252519569,7151724932369623030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ee3b30a1359db628dcaf6b053a049740

SHA1
35bb7a4d99bce5d4ff9e080b6078dd8d9ca9cb1d

SHA256
3d145dcba409bab26909c6090fe80bb55a0c030d226f26bb4e04b1bd495f5212

SHA512
6825eef8c8fc940d1e21c31e8643f969386fc5c5f467b6ae4a6709dd09f35632bfa2b87f3bc828a8dc6d70533dc7fbfcef6772e2b73586286680f4b567d92c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a16883674418363878995ab33ab3e98

SHA1
3908e31dc5857fa5e075f12cc8411f9b59d3f8d1

SHA256
f66e2b467f03ca366fc907f8d49ba360e1b8494f5c1e2fed51069a61948245e7

SHA512
c4a1daa55f6084dda18773a91d6fcdbd1885e1d5e67e0e9567810184a78da89faf4897626c8631c65df30bc2477d76d4f9fefdb35f5b96fbaceebfea95ab959e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2108e1f68841b574917d7f144de627c8

SHA1
815e314ac058305120c56cbc550c57e6dcfb9d9d

SHA256
8b9c0a13d3dc49689ded9bfa0aa87a22f5d2d782db44123d4cbd18dbb389b7ab

SHA512
17d2914ff8286536ebdd8a9f0401e328511befc9bcc2e1bdc1a7180edcd0485d802a922c4db7e11babd307b6c84c2c11a58d9b43ab7da36ac333d1c2d4d30da1

Download Submit