a6c9308ae859527f589b101de49a9b86c1ef4db2d3ef341474e6c4a1c9ad7fe6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/必看说明.htm
Size

6KB
MD5

3a3dd6a8121fbb4e4f1181e3b73bf01b
SHA1

6faccc6dcb27fbde623b91d877f4732127dcf8be
SHA256

05e6f40288872e4adf72a685297d6462c832401c945bf63b7e244a281b967f01
SHA512

3e0f55dca36b4684a6853bc8c59e6bf2b4a2e699ef76620c4197bb6b39fd0fe732de7d83d3efba0e64d0269ef7a1f2bc69c571355b6f9784e65db81cc3025eeb
SSDEEP

96:eygWlXZktTuDndkYWuokAbVXHISaQN1exgemaQNA5FaQ/APUgJX/kh8rW3H6aQNf:ebiXFDzeXdxfx2Fxh8rW3H6x9xQWn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
3588	msedge.exe
3588	msedge.exe
4264	identity_helper.exe
4264	identity_helper.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4328	3588	msedge.exe	82
PID 3588 wrote to memory of 4328	3588	msedge.exe	82
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 632	3588	msedge.exe	83
PID 3588 wrote to memory of 1944	3588	msedge.exe	84
PID 3588 wrote to memory of 1944	3588	msedge.exe	84
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85
PID 3588 wrote to memory of 1660	3588	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger\ArdamaxKeylogger\Ardamax Keylogger\必看说明.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9df2f46f8,0x7ff9df2f4708,0x7ff9df2f4718
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5225265750373455374,17874030141988095204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7e4cad1c1bbe327c1c5e9438fab8482a

SHA1
3a602eb8721efad403f8dedcfd0b7c0b74947dce

SHA256
dc9e304237ac80763a0bf672bddd8897e2613118f33a15f747afebfad4051fb1

SHA512
fdf49e8612149b71eb30c0dc99a0cea2b1c966c95eeb8039eed8ccde3793315ac0bd0e87daebe8c988b4a6101f0b5aecad0dad24a531c725a6f750602a1b3079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad0e559ee9c5d20bb9875d3e001ff736

SHA1
66d1a7b82f482be384e59211ae6ff9c40ec0fccb

SHA256
a1c621a62879163efd385c51ed35f43ee93d9e08c5e1c4496d5493928399e5f7

SHA512
44947a2348a779fb7e5877d92af7c2f50d6d4e27d59ba120a111191a624c0d99a6936b0f9977d0f58f48fc5e3c045d576bf679032176b3b8b87abb283c2ffac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
077bd22338084ea770b2a95e77fd8cc9

SHA1
4740ce7f7abd0409e16be64c6b9c5e6fc20330d9

SHA256
94e32a774d69c0f82ec6f41de8e357ae8e27cae59171c6add084ac1f086b9af3

SHA512
ce67b357b582109c6f21f17648d645133e9c43f1bf06460cf8682afad2ac190ff82d5ce1b2516d895ba4dc0808a5c2514d9bd2f1bf77a52e1ef29af4ed1436b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc68f5e14999d3ba21d85e76a260caa0

SHA1
7fc2ef955e5a45e1d2ff32e087fe24e9ee2132ad

SHA256
79d00254585b53520ff2e4409042d5f6ec256487505e692287c9e0e0766020c5

SHA512
10afff1c9fb8968a91b34e90c3739429e9fb7448a69fcf78a7017ea714b14ef9f15b711eda605885da93f008c1bea56abc943c720d76ea140315378ddb52f09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b28e6e131391582ad514ea438e4bcedc

SHA1
82e1570dfcb62db79c625e20808541b59937e68a

SHA256
1f7080966cfbccf1050f88acb06a8741235be9402c9f2bb69ab1a18b4e037f14

SHA512
7f9dc9ca6276816b6ac2b8eda4ee5da71523d429e84a4ff65526b714af8d128bba8869a1e02deff8a4ba774d47499f456d0e733bc348053cb957ad71ed94c09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23c110d525399d4640417a7d0455ab21

SHA1
e42f8c3dbf65bf6d5d374ea29e0f4e827426a606

SHA256
d3f85d222538dbeb5bb55b7ec757eec1c3b1b3957aca0e3860101dde73b67307

SHA512
6232beadec7abaa575e860c9985af2f87840e9875161967ab5c447e0edd54306e8fd9413430157ad149c9c4a20d1bdfed2f10b8e29d22af26edca62d07ce7a42

Download Submit