Resubmissions
17-09-2024 16:20
240917-ttcpasscrd 417-09-2024 16:08
240917-tlmjja1hrf 617-09-2024 16:03
240917-the1aa1gnc 1017-09-2024 15:53
240917-tbyh2s1fpm 817-09-2024 15:46
240917-s738qs1dqn 1016-09-2024 16:27
240916-tx94zaxgjm 316-09-2024 16:00
240916-tfqc8swerd 1016-09-2024 15:57
240916-td4svawflr 629-08-2024 23:57
240829-3zs3xazamm 3Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 23:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://valkyrieofficial.vercel.app/
Resource
win10v2004-20240802-en
General
-
Target
https://valkyrieofficial.vercel.app/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2736 msedge.exe 2736 msedge.exe 4928 msedge.exe 4928 msedge.exe 3184 identity_helper.exe 3184 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 4928 msedge.exe 4928 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4928 wrote to memory of 1472 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1472 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 3428 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 2736 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 2736 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe PID 4928 wrote to memory of 1188 4928 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://valkyrieofficial.vercel.app/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0x40,0x114,0x7ffc194746f8,0x7ffc19474708,0x7ffc194747182⤵PID:1472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3428
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:1188
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:4944
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5fcd9797ce2ce13cb9994b4b7fdc4347f
SHA1657bf0c226717fee229ff3bfa185e8c0b742c597
SHA256f23d2cc5a1ae0f2382cf4de2d05fdf8cdd641bdb9603560fa87a44128415613c
SHA5128a409f2be36c6a37718c03bea20c0b5126653548f517dabee59b4ab97aa662cbbc14bccfab0856658a97ac761de93ad8bb21a4fd1dced97a844aaa0e998457f9
-
Filesize
680B
MD5c8bcd5300181ae31d99ae90dd8784b27
SHA1d49afb9ba5733af565f5dbd404f48a4695d98550
SHA256b3593c9af65a5426278572cb221bf43a6409df2ac2a7d71f85f6939388ff7367
SHA512a189ba03591b193c26d61afa74e1ae8d6b1d79f588da472a6e57fd127d02b0f941b104f6b6e4eee380d94317f6cff031716d3216c2b378baf06d2b6cdc369038
-
Filesize
5KB
MD5c7d7e3b1956684caecf4004416d889b9
SHA1677516248405ebe520ab5b990b23404dd900f6bc
SHA256c7dd1d7bd39439e62c9eb3b1ef75756c10c16047b124d0b7567963bb83d29fd9
SHA512e69ee99469bff04e9e7f993bcba657473818480494d79c72e4f98c45d639886146b0b2de0d8d172fad3a7079da6bba77710bf212a189fc1661ff70cd2925050c
-
Filesize
6KB
MD52606719e48c39b86a3064c14f5300f7b
SHA18cc012db1b408cbc5f75c98a0fff6f9856397eb3
SHA2568d1e7597cdeb370a75d33bfaaf82fb98f72533a3838b5dc8ef676a315fa44ed0
SHA5125a792727a411d80ded7e8c3e0301c2410b57692f4df35cce4dcd111f6ee6f119dbecec233f9c49f8b9e5018b5e74177b6d74d0ffe1a2bd2905885a74953ee1c0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD508ff267ad6a353d5019d55d8e8e218c0
SHA1c63ca7574f814745760c038a627bc4d9646d33a5
SHA256f3e070625d75a84172c527e87e70cd98c14037a2f03f8d0bed9dc522833491cc
SHA512293eb2e1e1268f541ea0a1afe6222f48a13eda7be90be23ce8ea5aa165248ec24fdebb46a31a9ee107b485d30bca728bfe7c42f7134182a826079386b40a9fa7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e