14ce93ae01d50b9d2ff3c36c3edd574a9f8bcec56451f3a865fcc210c617a77b

Resubmissions

19/09/2024, 06:30

240919-g9r3psvepe 7

19/09/2024, 06:27

240919-g7tthsvdrg 5

19/09/2024, 06:21

240919-g4a71avcma 7

19/09/2024, 06:17

240919-g127bavejl 7

Analysis

max time kernel
96s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iz3lne.zip
Size

882KB
MD5

6b104ba9deb749a6b6ce88b9c6997dae
SHA1

19d9b52477606b78bdce568235c0acb9321c1bc4
SHA256

14ce93ae01d50b9d2ff3c36c3edd574a9f8bcec56451f3a865fcc210c617a77b
SHA512

26c804cca16e78016bead5fb43b5c2bca279beaf7edc062f756b43788dba89c49b9054028a271fe70bb1657ac61c704c0ddec38595b885cbd0d94cec1aedd885
SSDEEP

24576:5hQFuAEOVU1lerCPl2AWo44sBMG468LDnm:5hQFFQerCPl3jeh4Lnm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4660	1740	msedge.exe	103
PID 1740 wrote to memory of 4660	1740	msedge.exe	103
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 5104	1740	msedge.exe	104
PID 1740 wrote to memory of 1656	1740	msedge.exe	105
PID 1740 wrote to memory of 1656	1740	msedge.exe	105
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106
PID 1740 wrote to memory of 1164	1740	msedge.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\iz3lne.zip
1⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7414c0a5hb6c5h4156ha595heb2bf0292f62
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffec9c146f8,0x7ffec9c14708,0x7ffec9c14718
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15927816903754231412,14145703300917946296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15927816903754231412,14145703300917946296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15927816903754231412,14145703300917946296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e89a8507955aed8496d4c93cc564aaf6

SHA1
18f320cdc26e26236eef643dce93132cd7405e19

SHA256
fc8454e8a64a6d6d66729b496a3726be472980f47b13cf209b76feb1c459c838

SHA512
4cea15e0ff3446bc2c2fcbcf6f9cb31e9797314072983c7a086e84c416aa6aa477d9422f426e8f1468f8cdc0572ac7314a8a574e5d9b3946082d350e57baa43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1437dbe8ecbc42334aca1c3d65146648

SHA1
3adfa4841d52b312e9b19d4291f3e619a8a4465f

SHA256
2c4974c784408748ce03542106f15d6c07195fbc61ab854ff49c63fc23b5e905

SHA512
d065f0fddb6e860e3239e28b0faaf61b8b6e54bda8c1757cd2a029c02577d9c5e00bcff15f947506acabcea1d39599c75ec617e86f4ec306350b8db7a4b8cd2b

Download Submit