b972896caf4b255120b134929b297eb7ab80f4250e4e54c1809584d0a8f0433d

Resubmissions

09/09/2024, 11:30

240909-nmmb9sxgle 6

09/09/2024, 11:29

240909-nl2qkavgkm 6

Analysis

max time kernel
145s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/Monaco/index.html
Size

164KB
MD5

0f76256876f7c781074734134b53d080
SHA1

5d279e84c67a40c59f8a93ee0ca7071bb7518042
SHA256

5b28a84344bae9286b83f9ac8e1c16185a8b9608d8801b2389b12ceff0614ef5
SHA512

0b589afa314e70c98d2116c70d2af4f8e329dde743810e04c9af0f7448214ccc7c9a86ef498639ae33c3a77903a35be08db9ca264aff4caa57e5398ac6f230d7
SSDEEP

3072:gKl34J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pJ:d4J09BA3pZaFD48VOAGUWYPjdlLJbRB1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1968	msedge.exe
1968	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
2816	msedge.exe
2816	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3560	1968	msedge.exe	78
PID 1968 wrote to memory of 3560	1968	msedge.exe	78
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 4848	1968	msedge.exe	79
PID 1968 wrote to memory of 1092	1968	msedge.exe	80
PID 1968 wrote to memory of 1092	1968	msedge.exe	80
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81
PID 1968 wrote to memory of 2996	1968	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\Monaco\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbb5b43cb8,0x7ffbb5b43cc8,0x7ffbb5b43cd8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,14155257894867820965,7738031477140309400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
62fc8758c85fb0d08cd24eeddafeda2c

SHA1
320fc202790b0ca6f65ff67e9397440c7d97eb20

SHA256
ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248

SHA512
ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d735e6e912d0e6b76cf9a8b85174a4c

SHA1
09b1b2df0805b022a6b544ddd62be99fe5b4c2d3

SHA256
db52f2d6dd8729b293c0dc5c7573522922c8007ef05464af68f6217a1cc907aa

SHA512
4e3467ee63671d326400a839911a965e7cfe44b5befc87d6550c377fc296eecd859185e952535bc9344851b03f173aef3e369b11411229c7d69f34eb903cc28d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f48d2b095257a2458a66cd932433e1d0

SHA1
c79dc93bfaa45fb88f65de634f275fc0df10a865

SHA256
177c0aa24120770f5972a7788124b415a90623351e1cfa4c61839777827e8f39

SHA512
ac8e004a549a24bf0f1ef585c13c83e5a843a43723d8d023afe71f9ddee444e403845a4d6acc69a581be84664866a4196e63628ee43164ee5351b803ff1db4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ecd2bf1747ad7f6a9c76a652e088e158

SHA1
e4a419f72adbed1bd150944059554de144f2d2f1

SHA256
3b7915a9435b9b33f2181c48006291fec86f19f0e1d73d6c76561cca2be8df01

SHA512
9eada17775d274abab7de50e09ed3e6f45383b083d72a8d6dd1cf5af5adf311980f32cd72168144537f13d1b8fb24744fbc25298e994c484e7a505244b16a24e

Download Submit