hxxps://aura[.]com/payback

Analysis

max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aura.com/payback
Sample240905-tlmvasvepd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
700	msedge.exe
700	msedge.exe
4996	identity_helper.exe
4996	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 5088	700	msedge.exe	84
PID 700 wrote to memory of 5088	700	msedge.exe	84
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 724	700	msedge.exe	85
PID 700 wrote to memory of 4788	700	msedge.exe	86
PID 700 wrote to memory of 4788	700	msedge.exe	86
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87
PID 700 wrote to memory of 2264	700	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aura.com/payback
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb5b46f8,0x7ffffb5b4708,0x7ffffb5b4718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16212712209417533679,6171186810673188622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dda24af3428dc612c1e4301b7087d9e5231fb3b9a22087a06175d3540de2c261
MD5 057275e621575197b7cf2832f54cdd73
SHA1 cdacd1e8c61fc632e8bd7cd4d5fde476441e3674
SHA512 18024f47039e5fb50caae8e30ad8733075cda2450f656a9986ef91ac44a94cf68fb0ec9c889d50f91918753d351474fb34cb9742d2a883b1d3cb9ef6519c91ea
SSDEEP 96:nGkRXk1tuGkTtwpvWMoiVmdeHTbZBUWQyV+VDCziEwb:nGkRUd6GWMX/vro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 b304b3a27aab3c3755366216784c1737f1367d1d34e50cd01ffc80491a2746ab
MD5 32dcdf58fa49496301a3cd41912ba15d
SHA1 9d848a1a482e2ff5e69c102f1b70870928f4d550
SHA512 d3f5c88901d9b26b17cd224f5e997f9b0b974693c0135f8fe5ac38640ca42d5a75266cfa54395d1e8bc84b484edeaf302775cb5b3157be713dc366f1771be9d8
SSDEEP 192:nGkRLdC7P2WM0ueYhkuYvRSWcHoEVjhSeT27q2/yrg:nGEdJWl/38VML
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Size 99B
SHA256 6dbb97deee6f27d8b69e181b62e5f4c213676e8eaa383314cd45465cc3d46f91
MD5 1af5ad6453dc57d74bd3725242b263c3
SHA1 8687b15318abd9edcfd15d5f8fb1c0401b04b062
SHA512 ee90939a3025541e66d64d28625207259dc926378e2ff6adf23737578abd8f6f950c05311dff003de6ddbf230ad1c692992c6880eba6f73cdb6e6148463de0b0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Size 35B
SHA256 8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
MD5 343859b4ad03856a60d076c8cd8f22c3
SHA1 7954a27de3329b4c5eefd4bdcb8450823881aad6
SHA512 58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 00b9078fc791ce49ce6e4ccde659f36c393a0dbbc7483928cc33bf1f673b3b99
MD5 6e82cf33a4074fab690eeae1fa1365bc
SHA1 b9c2eff1267d4950f3c14694e5d629c1dd4c53f8
SHA512 5e4dd0e3e387b59b84a68e7d79a3655e504f90c107ff4a71c0aa0d1f656c1bc72ae8c369e0d7abe57ba7bccbf453a68a8ae917efda62c526557609b7e4292068
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupe3RFe2RUrfkjD4pBiZJY:A9iIxuERzA83h09RZxYe3RhHD4pr
MD5 SHA1 SHA512 SSDEEP

Submit Download