Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-de -
resource tags
arch:x64arch:x86image:win10v2004-20240802-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
12-09-2024 11:32
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ipfs.io/ipfs/QmWcXQDmLLvGeTunK4K6JfvyMXKUYrSyRAumd64BwqdPpz/#[email protected]
Resource
win10v2004-20240802-de
General
-
Target
https://ipfs.io/ipfs/QmWcXQDmLLvGeTunK4K6JfvyMXKUYrSyRAumd64BwqdPpz/#[email protected]
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 38 ipinfo.io 39 ipinfo.io -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4924 msedge.exe 4924 msedge.exe 4000 msedge.exe 4000 msedge.exe 4008 identity_helper.exe 4008 identity_helper.exe 4364 msedge.exe 4364 msedge.exe 4364 msedge.exe 4364 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4000 wrote to memory of 4592 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4592 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3692 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4924 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4924 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4552 4000 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ipfs.io/ipfs/QmWcXQDmLLvGeTunK4K6JfvyMXKUYrSyRAumd64BwqdPpz/#[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d58246f8,0x7ff9d5824708,0x7ff9d58247182⤵PID:4592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:3692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:4552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:12⤵PID:688
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:3004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:1464
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵PID:3244
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:4252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:3288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:2076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15942470147121903391,7857179284622128343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD52b66b8414480eb2fd23196984e5eaca1
SHA1ea37258cf4108ce2937f7b1239f0d0a81ee2dd1f
SHA2561a6e15005d3f477e128c5e53147fa4eed5242f6bf789a464bebf85f6b86c031e
SHA51291345324669fc1d84f5d4472ad1947b17c411f56b199136a1bf8d4a409259ef935794a79655c3c7ad9dc81c2ed948ded0ae3a4bbecb4edf4d7cae07af1e520f3
-
Filesize
2KB
MD5f98bf7dbfcb7009da2cfccd710358eb4
SHA1677e450626cacd60105deaab753641e7536f8fc6
SHA2568044dc42011dfd6e3e28a1fa2b0c12bd4bd97751d28194dc1721032431495fa6
SHA5123b9b1886bbb27610524606785b82366722dfd1e7319727ccafb9160a8bcc89b60303f1a4cd4063c32b3ec96a22ea7c7120f1c475917911f667f8547d88b1089f
-
Filesize
5KB
MD5a0cd8caa7ad6ddc2e70af749b6defe9b
SHA1703fe0669522c85983d9c79c67b667490b6161c7
SHA2566bf361796ac9c2cad12b29cad8c785c552e288eaa6e3af26096a810aec2ac699
SHA512d79231943738b1a21e37621815871b180125c3540c35b07b05acee272a0d1030ed9d5a4ae71beac4f5c46a47d0b18dc6ea6c48dc05b2f97ddde2fc8da5ec5a8b
-
Filesize
6KB
MD530f0992f798af5971eb5b16244a33902
SHA1373fc9ae0b722452fcfbd380ea452a3bfeea7c78
SHA256a11b904982a713948bac93f565b1a4722baaead212bf7ac40d324ebd728f771a
SHA512af8ac10daa974851c3521e557f110c149268ba0a6536497c6024301039afcdc54bbdad0899dd7a26b6e39edb94ca653d993b68e51717c732462ddcfeaf691759
-
Filesize
1KB
MD565b7f9d4ae011d65c947051261d258d8
SHA13864ebf4f7d1fa4f491370ac6a45f2c2474e2e45
SHA25625fd78c4690eed811e7b832ff4766fc0a34b769491b4a46102cf6bbd42143954
SHA5127cd0c1d48bc4825148ad8e2edc55829bb7587d86a7761402d644c9efa4b796be545cead1a5cfe804c71ae9dfbaa4e8536d976283022967f059bf6d5239a4a8f4
-
Filesize
1KB
MD5621b828f12891983e66942cfa1f7938a
SHA1e241f4e40e39007bbfb6a15b2f2c4f49cdd02893
SHA2569913c6276e6a512d0c2b3453555e338e10ae125bd0910f1228af98f9b7a4eff2
SHA512ce17da19d87439366cbae7bce4679d720a6307b60d06c5ffed8a18435477a141c87cd149199e69d4177a42a5af405e05661135811b6910d06af40c997dd2be83
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ceca8bb11b016cb40809aecb26d4f669
SHA122649e93e28e028527ac5d96e97c384dd31bda43
SHA256eafafd123e032f6cc65e12072ffe9c318df3b350c2b29d02c21ea48b2f2cbf4a
SHA5122715cbba20d493ee4216c815c8de270a0d4aca6127afbe1bb95f2335a2a345251532dda68091c24c2fbaec003ef7b0473e38acbdcd074b565f31b21a6cf3ae03
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e