hxxps://apkcafe[.]top/download?file_id=2439516/coop-smart

Analysis

max time kernel
293s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://apkcafe.top/download?file_id=2439516/coop-smart

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3744	msedge.exe
3744	msedge.exe
4092	identity_helper.exe
4092	identity_helper.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 3188	3744	msedge.exe	85
PID 3744 wrote to memory of 3188	3744	msedge.exe	85
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 940	3744	msedge.exe	86
PID 3744 wrote to memory of 3732	3744	msedge.exe	87
PID 3744 wrote to memory of 3732	3744	msedge.exe	87
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88
PID 3744 wrote to memory of 4508	3744	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apkcafe.top/download?file_id=2439516/coop-smart
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae52946f8,0x7ffae5294708,0x7ffae5294718
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15875709365727101287,10495487880987787280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4a49b3da3a9c11274029ac479164ec59

SHA1
f4a60b6a1bab6cdbe5acb4a5bd1d3c4f93023d44

SHA256
5bd2e12e2442013b8fb10d2a93008b5121bd0ec19e381dbc20511c1b3cefbf68

SHA512
c9eaebdfc07e37b6fb2274e0121da376443cae9aab0d2da12a5f516c7ecf60a6dc95b58fbe06928e625bbc86bdfbdb174a4420e18c341bf36b53aacf584da702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea978c599fb8126e9d73fa3372150246

SHA1
a784e2a592d5a1c6b197a09a75b3cafbeb7dd957

SHA256
2d385decf60242dd8c6e71f4d61caaf21e87ae2f0f21844b0a51749ca4bec3a6

SHA512
0b35b7f337bbe1317c348543a71f789602f0ad8a929a09aaa323cfe0ae3eff21e40becb46f0ed64392d443ca8b1f8d1c5ada263e3a45009d26a5d790a22d275d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b71f7ebdadcce97d8d3a529f1cfd481b

SHA1
b776e0f70e97114aa9464d0df26d6be06aaa8ac3

SHA256
1906cf2eaff4a62ac3987b08c079791e4e86466668c2bd77bc68b49a5b054e0e

SHA512
4690cc2e98730c3663e405a71f73c0ed1764ee88cefeb2e7698c507356c9f640e28d640221bfa3f712c214ad139b4407b9b14db335f752b1f79bb51da9d56358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cfb534b2fe840759e720d22c8f181c0

SHA1
0d684bbdb161fff9fe2537debb0be4f2648ab025

SHA256
c38f900901c37e63946fa57bf989a89695419ad4407d54ccc63e08272d0e761f

SHA512
a8f69848c477dee4f6d9f60e6df453270982b121422fd5999eded08137b79c9e1a1cf167c76d208e51d279926f437866304ec691159e865550ca8b7fe6f68680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a9aeefa176a283f736cc4a210f3b9a7

SHA1
9f5714217806dfd8efc90b6e6e83d5e05ca5485d

SHA256
4707bce82f31083719f750ab2b4d54404b817e676fce3d074bc976ddeb9776ec

SHA512
7386cfec1e88a33b4a2339eb5ae13b0a6ffa58d0baf9cd87522b368a5e7e03608ced66aee81d2f0b059132cab971df514a2fa97f6e910f18afce5cc31bf223b1

Download Submit