Resubmissions
12-08-2024 15:01
240812-sd558s1apb 1011-08-2024 12:42
240811-pxewlstgrh 1011-08-2024 03:59
240811-ekb9vayanf 6Analysis
-
max time kernel
304s -
max time network
282s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-08-2024 12:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win7-20240729-en
Behavioral task
behavioral3
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win11-20240802-en
General
-
Target
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 909662.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3076 msedge.exe 3076 msedge.exe 2092 msedge.exe 2092 msedge.exe 3732 msedge.exe 3732 msedge.exe 5024 identity_helper.exe 5024 identity_helper.exe 240 msedge.exe 240 msedge.exe 240 msedge.exe 240 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2092 wrote to memory of 2212 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2212 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 1228 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 3076 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 3076 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe PID 2092 wrote to memory of 2416 2092 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa49bd3cb8,0x7ffa49bd3cc8,0x7ffa49bd3cd82⤵PID:2212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:22⤵PID:1228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:82⤵PID:2416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:784
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:3144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:1152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:4772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,5941931247898684800,10077248360606278821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1196
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50487ced0fdfd8d7a8e717211fcd7d709
SHA1598605311b8ef24b0a2ba2ccfedeecabe7fec901
SHA25676693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571
SHA51216e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993
-
Filesize
152B
MD55578283903c07cc737a43625e2cbb093
SHA1f438ad2bef7125e928fcde43082a20457f5df159
SHA2567268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2
SHA5123b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601
-
Filesize
188B
MD5274920e8b7cab36b66f3e178f5418e29
SHA164e149e0b8bca1c5ccf3398c4dba801c7d765a97
SHA25630112d1e41c9ca55edf0cb77d785886d162b5cfff6b5e418b48396aae7f8e4db
SHA512eb1f76893293dc0af1918886ee3162a240ee5bdd21651ae3b7a94102194a773a223ca93c7e5bb751b02d78f437c2e7af2504d601d94f71d63edbf3424bde431a
-
Filesize
6KB
MD5f23b16288b6a8fe3ffb14c51e1d4e434
SHA15b15096be0784586a771015bbe7b0572f65c9661
SHA256f2f18804f932874e510f166c9969b74ab9c3190f0315960836c1a5d548b579b2
SHA512e8a2f504e929267a2c7d56b28073f73d4221f43a19716820c54ad08022cde919ab50473cc1f3e2a3946fb02b4c822e2ba926862c1ffa1f77e88344fcc7d62902
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec2504dd-5f4d-4648-9016-ef0c6bb68e9b.tmp
Filesize6KB
MD58e68ca8f1d7343cce08424d17979ed39
SHA16098e53e7eeb5a66c002c81396efebbcb7bf3f64
SHA2564a0a83f677a4b3c2515ca810e3f786b22074d744d58407a92be88b6ced61f5d9
SHA512b8aa7e72e88429d2c551605bd61a30d9cd80cb6243387bbcbab90e520747747333e097a88adfef53e8a3ce32061c5d0df768e88ba44e211e286e8e645e2550f3
-
Filesize
11KB
MD5276a9d18eb68a753a6147b7dfd5efab5
SHA13ad1ae7cd169ce743d48da0e9b24840649fd7c00
SHA256991050c1c767f115c549437e62688f01fadc597f49cef6fd24c5da305c36b768
SHA512948c397d85f5e4d3d5b8e17c92145f2a012da164b49cb7a14bab98db483125724346383f679d13f984f07054f9e1b61a253fd0bd60113d337a52d401b2fec58d
-
Filesize
11KB
MD57c8cdf5c79ecc5339993ba35ac12d69c
SHA1ba979bee6aaa6e960a5bed921a9a9b3426dce2dc
SHA256892dfb24cb8fa6c0748332600e859368aa1fc1aeee94071f7a605c8c45b2edd3
SHA5123f14e101165582bfc9a91f150033f006d45ae01099c2c9438ce32736df3c97cb14e184868c1ce18db5a3ff727cc13735ab7bc683e78a1263afb36f7575025696
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e