Resubmissions

15-10-2024 03:47

241015-ecgjlashrh 10

05-08-2024 04:49

240805-ffygys1eke 10

05-08-2024 03:50

240805-eee4jszepd 10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2024 03:50

General

  • Target

    1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

  • Size

    179KB

  • MD5

    c2fea37aa19c947614c20fe2ad3aeef2

  • SHA1

    16834915e3db38b5b954c2099d77bcb700428588

  • SHA256

    1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845

  • SHA512

    e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59

  • SSDEEP

    3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
    "C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5096
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://github.com/temon_69 & start https://github.com/temon_69
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/temon_69
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3172
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8106846f8,0x7ff810684708,0x7ff810684718
          4⤵
            PID:2972
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
            4⤵
              PID:2352
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4456
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
              4⤵
                PID:3684
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                4⤵
                  PID:3936
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                  4⤵
                    PID:3268
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
                    4⤵
                      PID:4124
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                      4⤵
                        PID:4460
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                        4⤵
                          PID:808
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                          4⤵
                            PID:4312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                            4⤵
                              PID:3500
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:2
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4360
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:432
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4592

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            4dd2754d1bea40445984d65abee82b21

                            SHA1

                            4b6a5658bae9a784a370a115fbb4a12e92bd3390

                            SHA256

                            183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                            SHA512

                            92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            ecf7ca53c80b5245e35839009d12f866

                            SHA1

                            a7af77cf31d410708ebd35a232a80bddfb0615bb

                            SHA256

                            882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                            SHA512

                            706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10fbdf5f-2439-4a11-b283-0db3ef9fc3fd.tmp

                            Filesize

                            6KB

                            MD5

                            7252cb3915101495583dfd3202faaf02

                            SHA1

                            2e8c8fed40a027f60b43f83f3b823add3d349b98

                            SHA256

                            1cbe3ee5d1b7679cc072b04acb152c014a7f30011181c907932e0ec59e326b55

                            SHA512

                            09a630ed60dca5a1c17b59013ad3e420fa496df53e55053d97bc9be6b52d4968cd234712d230f76ed842eeed2e6ab0c3b21528da1b351919558405443c2ac5e6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            1KB

                            MD5

                            f6b3840cc50fd95398877c2c36838843

                            SHA1

                            ca4a75efcc8277e3c9ae372a4529490b567fefb7

                            SHA256

                            3b4d64e03f36bf5e2ab4d4385f10ab823c959157f6fa408bf0f314b52dad63df

                            SHA512

                            66607ab356c814b2d010eecf2ac8a9652ef676a30dd402dfe3b9d8df6e01ebfd2c381206ab4b03b9a03823c8ae90e5c837af8de547f40c056af8faccfafdf6c1

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            409B

                            MD5

                            5fc4e74c4d38bba219819f874c0113be

                            SHA1

                            a3fb5b9020c46ed9101423f7dd81d335aec02bb9

                            SHA256

                            19b94f1cee30d5c9c2c0c15572c39aeace2842405c906faaf5b2c7ba7b34e910

                            SHA512

                            b5625e4761ee52e339b9638d0d80db992fbce3552dd6574573d9c16e161c124177c8f5b1bdc70a78d82a252630dd73054179f73645a1d6954425daf9f01d6575

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            e793478001759a4f004d16042e8b2783

                            SHA1

                            35aeb27e0b9f80d058662aa34d995508bd828e6f

                            SHA256

                            11cba9149fcb7e050e7787e2f8a0218ad0996115f4501fe18035dda24e19be33

                            SHA512

                            ed5b858769df4c8b0f96070b3dfefcc2de5241d9d99b0dc0262eafc60ab41f2bc8cb9f6159411f87b2c7d4b942bbec3fef5c877c3cb7d6f475a9592ff8d6363c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            732114c5b092e85b1501bc13ff1d3124

                            SHA1

                            061ffadb01416de8dcdb55278edfe52841408aa7

                            SHA256

                            6dadb17ab2d0fdf09c501abfbc2447fb56747c267bcb0f70b18096fa04138822

                            SHA512

                            ee3b2fc0c4d8fbb24fed81dafd1f021ed5ec65b1c0bd1d2a055f4f9a42567dc36221021efd78fd8b57eeacf976ffc43e950ac8b6d8f1541168baf3f857254510

                          • C:\Users\Admin\AppData\Roaming\Read Me First!.txt

                            Filesize

                            268B

                            MD5

                            bc7ee9dffb2cf55f5fca0b0602a5f933

                            SHA1

                            7d7def061aa3ae9c0467cf5f126fa76b7b167482

                            SHA256

                            b2b02392520557f11412437591845f013382f25a7df3c5528045ac2ba400d711

                            SHA512

                            2d7bb4718a22669cbe96db6ec712c958c2154ef18c3d339262a89ca81868921df14698669f1c8fdbfbeb908b37784887c0383cb7663d3cbd6a6d4594597b3ed5

                          • \??\pipe\LOCAL\crashpad_3172_FEHIXGGMHBRETLXT

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          • memory/4884-17-0x0000000074D80000-0x0000000075530000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4884-5-0x0000000005040000-0x000000000504A000-memory.dmp

                            Filesize

                            40KB

                          • memory/4884-4-0x0000000074D80000-0x0000000075530000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4884-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

                            Filesize

                            4KB

                          • memory/4884-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp

                            Filesize

                            584KB

                          • memory/4884-2-0x00000000053A0000-0x0000000005944000-memory.dmp

                            Filesize

                            5.6MB

                          • memory/4884-1-0x00000000004E0000-0x0000000000512000-memory.dmp

                            Filesize

                            200KB