Overview

overview

4

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-1703-x64

4

Resubmissions

07-08-2024 02:07

240807-ckec4axhnp 1

07-08-2024 02:04

240807-chntra1fqd 4

07-08-2024 02:01

240807-cfxzmsxgln 4

07-08-2024 02:00

240807-ce9xta1fke 4

07-08-2024 01:57

240807-cc95ss1emg 3

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2024 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://cdn.discordapp.com/attachments/1270510446109261876/1270544279130869770/KIRAS_BOMB.zip?ex=66b41611&is=66b2c491&hm=d2be13894818b51a7e1d79d15b2986eea1c36ed32863f840ae7f996338f32312&

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://cdn.discordapp.com/attachments/1270510446109261876/1270544279130869770/KIRAS_BOMB.zip?ex=66b41611&is=66b2c491&hm=d2be13894818b51a7e1d79d15b2986eea1c36ed32863f840ae7f996338f32312&"
    1⤵
      PID:4896
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4208
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:1488
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3676
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5056
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1816
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2420
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:644
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4316

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF1F7E34385B3E7ACB.TMP
        Filesize

        24KB

        MD5

        96db9e002b705afedf9dfb21ed3fadcb

        SHA1

        8a8fa3053aec800b7ec218f76bd65ac3e0b49fff

        SHA256

        9acf2a836ca6c1c54b97d2e78b3c03e8014ed1ed3eec1b881d642063ab5828c7

        SHA512

        8f30c124f8b97176dc23d9aa1501d04dd146d68b5de1a6d3790eb7dd2b384ee20769307de87050f0b7ef568962349fea33457dbec4f0c24d7a2c4b8f6e539aa1

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0BANRQ9\KIRA'S%20BOMB[1].zip
        Filesize

        352KB

        MD5

        e822996670c265a00f83d54f019d61ec

        SHA1

        77bbe3afcfb24faa1f3f43b339cd7120fe4c6e53

        SHA256

        db082f169699a73f4b0482286cebbf8a8715e55c30aeea02eee60af742d1c6de

        SHA512

        9011a3dfedae602fb3c47d4557968afd99f16617bbdb1f932a45557ee5fe95815371e6895409601a682cc5e357c6b4c39327e745218c877991d8f01d0d3fa3da

        Download Submit

      • C:\Users\Admin\Downloads\KIRA'S BOMB.zip.am0g8z3.partial
        Filesize

        1.7MB

        MD5

        979597208a38213bf7112ae9ca45dfba

        SHA1

        63b104406bc10c81709d449e923f25a7d5b94b29

        SHA256

        f88c973c4051f35c62a75d732eafd0e5dbd653a3943c502134c492dd7f67cab4

        SHA512

        1c71c7a378d79afeba15706c1d25ab8a2c82a86e4a438bcced0983ae618b7fc7cb081e7166e33f6ef4c4c94dec8349fdd467b5763bb0955213c8fe02ffffbdf1

        Download Submit

      • memory/1816-62-0x0000015862C60000-0x0000015862C62000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1816-59-0x0000015862C30000-0x0000015862C32000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1816-56-0x0000015852B00000-0x0000015852C00000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1816-64-0x0000015862C80000-0x0000015862C82000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2420-73-0x000001F6897C0000-0x000001F6898C0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4208-16-0x0000024074920000-0x0000024074930000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4208-35-0x0000024071D60000-0x0000024071D62000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4208-0-0x0000024074820000-0x0000024074830000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4208-109-0x0000024071DF0000-0x0000024071DF2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4208-112-0x0000024071DB0000-0x0000024071DB1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4208-116-0x0000024071CC0000-0x0000024071CC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5056-45-0x000001B31EC00000-0x000001B31ED00000-memory.dmp

        Filesize

        1024KB

        Download