hxxps://www[.]mediafire[.]com/file/6vdhxioubvnjscl/Built[.]exe/file

Resubmissions

08/08/2024, 18:42

240808-xck6wsxdqk 8

08/08/2024, 18:39

240808-xassysxdmq 8

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/6vdhxioubvnjscl/Built.exe/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
3100	msedge.exe
3100	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 524	3100	msedge.exe	83
PID 3100 wrote to memory of 524	3100	msedge.exe	83
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2728	3100	msedge.exe	84
PID 3100 wrote to memory of 2948	3100	msedge.exe	85
PID 3100 wrote to memory of 2948	3100	msedge.exe	85
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86
PID 3100 wrote to memory of 4428	3100	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/6vdhxioubvnjscl/Built.exe/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c7d46f8,0x7ffc6c7d4708,0x7ffc6c7d4718
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16150981704095505626,16565373133902536073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
05f64ff4961ee59618ad4052de169602

SHA1
0405cf8ad2c3957dac5ab591d5c0aef1ddb52be8

SHA256
0cef28d7266bdb47dae6c069d48fcb83285cddfbc56abd3fa36e414b8f5aae92

SHA512
f3432170a07b66353be5fc731aacced3775d0b7519e30d3cde503910deca57a57689f9fe2f5b5aceb1be3e4347ff0814c54a0ee7e4fe326d73ccf1846b97294f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fd25e55387c15e3521c29aaad32f2529

SHA1
03d418270b1718bd817ed467e1397e2264979966

SHA256
8de4ea1ec964f94f040ab8fcad3531799e1dc30d2c9ffe0dbfa227b67f4e45b9

SHA512
96a8da56ef13cfad26909cc4593e74721be811f710bc0d1efdf8a492dc8e8fda253beda7c8ff527fa15f05294519ca4781a01afc6b8b78968af227d222984cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
230a51a84e9e8ec032886bcb33f97ceb

SHA1
484cd9809b720345f8d3901db67e4e5890a66629

SHA256
d0ad4c1fc28cb04cf805da7359c0c42d460625bfccc3ddd6c4775df9abc3e1fb

SHA512
60d7ab437d711f743bf753b8720458580f71e52e6bee310f7349aed6dc12892a9fb0f650e31568e6fac00f586a6104b0a88f55931e968900328eab3f60786601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0811fc4f422b9141798dc963e5df6a5e

SHA1
faef08bff004f5a1a4e74e36d6a92a849b1693d2

SHA256
a996ea634c94dead063a9bad8e47ed892dd7c2af9c50f3f4f07be31d41b252d2

SHA512
ed1707fe777cd7e652be80a6e3a7bdcfa5fbeb614d7eedc6132f442154bee6eade10c2a71f9d27187daedb169cb6f90240bb07333cb89345d5d0a54856d59a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
812510219cdd7013df92e41d02dfa018

SHA1
4d4fc457e0cd2eda2baac0ed27a5a05a80f9b2ea

SHA256
91e4ea5aa7ee7221bb2384f24cdf10ddc295925064a2bf1b86a5efa0542c8db8

SHA512
e007afbb7431259b8856ca582eda276ca1c459788a141b62809c4a0395e3733a472ccb56fafb3b01275225e28b8a58f3acdc7838c0621b27e47c1dc1415988b6

Download Submit