Resubmissions

17-09-2024 16:20

240917-ttcpasscrd 4

17-09-2024 16:08

240917-tlmjja1hrf 6

17-09-2024 16:03

240917-the1aa1gnc 10

17-09-2024 15:53

240917-tbyh2s1fpm 8

17-09-2024 15:46

240917-s738qs1dqn 10

16-09-2024 16:27

240916-tx94zaxgjm 3

16-09-2024 16:00

240916-tfqc8swerd 10

16-09-2024 15:57

240916-td4svawflr 6

29-08-2024 23:57

240829-3zs3xazamm 3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 23:57

General

  • Target

    https://valkyrieofficial.vercel.app/

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://valkyrieofficial.vercel.app/
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0x40,0x114,0x7ffc194746f8,0x7ffc19474708,0x7ffc19474718
      2⤵
        PID:1472
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:3428
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2736
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
          2⤵
            PID:1188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
            2⤵
              PID:4644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:5032
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
                2⤵
                  PID:4944
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15583930337189160528,15792379260922592328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3184
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2940
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:4488

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    ab8ce148cb7d44f709fb1c460d03e1b0

                    SHA1

                    44d15744015155f3e74580c93317e12d2cc0f859

                    SHA256

                    014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

                    SHA512

                    f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    38f59a47b777f2fc52088e96ffb2baaf

                    SHA1

                    267224482588b41a96d813f6d9e9d924867062db

                    SHA256

                    13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

                    SHA512

                    4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    96B

                    MD5

                    fcd9797ce2ce13cb9994b4b7fdc4347f

                    SHA1

                    657bf0c226717fee229ff3bfa185e8c0b742c597

                    SHA256

                    f23d2cc5a1ae0f2382cf4de2d05fdf8cdd641bdb9603560fa87a44128415613c

                    SHA512

                    8a409f2be36c6a37718c03bea20c0b5126653548f517dabee59b4ab97aa662cbbc14bccfab0856658a97ac761de93ad8bb21a4fd1dced97a844aaa0e998457f9

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    680B

                    MD5

                    c8bcd5300181ae31d99ae90dd8784b27

                    SHA1

                    d49afb9ba5733af565f5dbd404f48a4695d98550

                    SHA256

                    b3593c9af65a5426278572cb221bf43a6409df2ac2a7d71f85f6939388ff7367

                    SHA512

                    a189ba03591b193c26d61afa74e1ae8d6b1d79f588da472a6e57fd127d02b0f941b104f6b6e4eee380d94317f6cff031716d3216c2b378baf06d2b6cdc369038

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    c7d7e3b1956684caecf4004416d889b9

                    SHA1

                    677516248405ebe520ab5b990b23404dd900f6bc

                    SHA256

                    c7dd1d7bd39439e62c9eb3b1ef75756c10c16047b124d0b7567963bb83d29fd9

                    SHA512

                    e69ee99469bff04e9e7f993bcba657473818480494d79c72e4f98c45d639886146b0b2de0d8d172fad3a7079da6bba77710bf212a189fc1661ff70cd2925050c

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    2606719e48c39b86a3064c14f5300f7b

                    SHA1

                    8cc012db1b408cbc5f75c98a0fff6f9856397eb3

                    SHA256

                    8d1e7597cdeb370a75d33bfaaf82fb98f72533a3838b5dc8ef676a315fa44ed0

                    SHA512

                    5a792727a411d80ded7e8c3e0301c2410b57692f4df35cce4dcd111f6ee6f119dbecec233f9c49f8b9e5018b5e74177b6d74d0ffe1a2bd2905885a74953ee1c0

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                    Filesize

                    16B

                    MD5

                    6752a1d65b201c13b62ea44016eb221f

                    SHA1

                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                    SHA256

                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                    SHA512

                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    10KB

                    MD5

                    08ff267ad6a353d5019d55d8e8e218c0

                    SHA1

                    c63ca7574f814745760c038a627bc4d9646d33a5

                    SHA256

                    f3e070625d75a84172c527e87e70cd98c14037a2f03f8d0bed9dc522833491cc

                    SHA512

                    293eb2e1e1268f541ea0a1afe6222f48a13eda7be90be23ce8ea5aa165248ec24fdebb46a31a9ee107b485d30bca728bfe7c42f7134182a826079386b40a9fa7

                  • \??\pipe\LOCAL\crashpad_4928_PGNGTGYYPMTEQHCT

                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e