9a5660d44f613410a4d517ff40e832b1bd7716b0436c0141af8606de43617bcc

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/Monaco/index.html
Size

164KB
MD5

5cbf65a134980384bfeecf4b5e8f1019
SHA1

a46ef8911f68d7a7838976cdc05530b184e503c3
SHA256

7b6835dcd60ae53b3e05f6de758925d2643e271ec4c1eb60a3aeb7e8f7161a37
SHA512

d39cb7440c7ae0a7e32480ba4dae79476b528041281161bdae04b552f6ede81ad73aa0b43d57bff0cc4741459828eb184991e4c12c329f8b87b0e1abbeda5642
SSDEEP

3072:gKl34J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pb:d4J09BA3pZaFD48VOAGUWYPjdlLJbRB3

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
828	msedge.exe
828	msedge.exe
444	identity_helper.exe
444	identity_helper.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3300	828	msedge.exe	81
PID 828 wrote to memory of 3300	828	msedge.exe	81
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 1732	828	msedge.exe	82
PID 828 wrote to memory of 3240	828	msedge.exe	83
PID 828 wrote to memory of 3240	828	msedge.exe	83
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84
PID 828 wrote to memory of 1948	828	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\Monaco\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff07c146f8,0x7fff07c14708,0x7fff07c14718
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1145093773844187499,4439146730075542120,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
62fc8758c85fb0d08cd24eeddafeda2c

SHA1
320fc202790b0ca6f65ff67e9397440c7d97eb20

SHA256
ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248

SHA512
ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e873ae24994b498d4169e2edbb6ec1a

SHA1
419ae691e34d71ee75dc2d0d1476bfb088a9e0f6

SHA256
515ab5fbe0193b934b3ec36a9573d6d5a6023dac62283ddd98bd20cde0139406

SHA512
d70f7ca51e6f730add87d197df7eeb0725eb14fa662959465a39a12cf653c92390af65c98cecc0d24e33e47b867eea6f9230848fde02e646f1e7737f12aa8366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56863990197e103f90665028f46c49bf

SHA1
cf4efbbd7573cd244c1c29482dc462f804e5fe7b

SHA256
94f55b286b32758ec293866a53af37dd90e756bf04634684c88d3ddfe6697d2b

SHA512
adb6964bdc047fae68c4034240d66977c8604debaade410837ddfab1bd3f74910ee25e63e97aa0859521e5ed36e9c7f0e88f378521009378d5600b65bcc36e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63983825231be040119bab587a3c2dad

SHA1
403baad7f6d81a88aa9f09a3f1cc23b8ff1eaa08

SHA256
845bde097497cbdc61572157906411309b1a6589f2cc7d574673a498d7f5c0c8

SHA512
24aef225b0aa7ae5744ccdaeb815771e230429eb5e9ebc797ad5583856841acc5590b4252ef41374291b09ec6499dfff1e13e0ed85050b6ae11a8dfabe4f003b

Download Submit