Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 10:19
Behavioral task
behavioral1
Sample
先登仓库管理系统3.0/安装说明.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
先登仓库管理系统3.0/安装说明.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
先登仓库管理系统3.0/客户端安装/先登仓库管理系统3.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
先登仓库管理系统3.0/客户端安装/先登仓库管理系统3.0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
先登仓库管理系统3.0/数据库安装/先登物资管理系统(数据库安装)3.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
先登仓库管理系统3.0/数据库安装/先登物资管理系统(数据库安装)3.0.exe
Resource
win10v2004-20240802-en
General
-
Target
先登仓库管理系统3.0/安装说明.html
-
Size
6KB
-
MD5
89cd338a2592a9abec8d0ad905b07bfe
-
SHA1
09f8c58b4d0b9df6b721a77bfef6c8ed3abe3653
-
SHA256
bf21cb3253227ee4e79b43de894f7212ee2ce393fd5ed8c15e90e34b2f90beff
-
SHA512
313abbad9dfba111040ca5f3f65193d22add318a3c51a5b676dba25d97f29526e04416bf724ab0b8e64fb2e1971fc1df450c2eb720090772b1f4dc7750a8c528
-
SSDEEP
192:c9waNKaCAjLRH4HF8TEB69U2jhawUCS/8aUpCaCxg8tHU9xXocOdoyGoXtoza+:caaNKQKHFcy6KahaN7EIEC0MIOq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 2624 msedge.exe 2624 msedge.exe 2392 identity_helper.exe 2392 identity_helper.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 1940 2624 msedge.exe 82 PID 2624 wrote to memory of 1940 2624 msedge.exe 82 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1916 2624 msedge.exe 83 PID 2624 wrote to memory of 1724 2624 msedge.exe 84 PID 2624 wrote to memory of 1724 2624 msedge.exe 84 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85 PID 2624 wrote to memory of 5064 2624 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\先登仓库管理系统3.0\安装说明.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8eb3846f8,0x7ff8eb384708,0x7ff8eb3847182⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:82⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4639898290735507421,5604231755976296536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
5KB
MD59a955f2057f46a027a1198d5fdae96bc
SHA14689db1bfd162d21353508d9d75de351334262c8
SHA256bdffacfb89387a858708079ca292b5fe121f55cd51e70d689fc1a5f4fd16d857
SHA5122fe7528243cac8a8f0c0d2e0b7aa3351aa16a643d70a2ab3fa3d2ae4ed976bb17d1abd60da75cf1c5447e2f0d4c28f68e9f53971b5f3b8f51bcfd28c5d57c3c3
-
Filesize
6KB
MD5411a77abe05e60a2b96095f153959b3e
SHA1ec5cfff69bef02f6dff916dab32112d3694334b7
SHA25646b558022781bc396b9e1e6c513c4fec6f0201071a1c0ad78fc22dccab4c07b9
SHA5122eac0fec419e9e288d75a4c2ab6c051499976695c2c4402a1a738cc8247814af5859abc9a2aab27478735f3dd653d1e3f5afdcc1775240461c2afbc52c8e9ef2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD579c318ccccc74968dfd4acaf0b2cb8fd
SHA161a22479e8fa83869e8a1ae541af77bf437790c5
SHA256f19a08b5ba0830cf5732909040b7d924676a67a52683f53526912d5f96b01d66
SHA5128eaa43b5dfe24198e6e8bc5f58aaec4e76ef03fafd5ece451dd56af7c4e7a5f392ddf68c43130d77b44453c6dad11df15cc0a22c833a8935de036b2524edc39e