77bb35807e4fa5ccde415bfaa04496fa64e69e0c8a08163a37f3ba77af5f97a2

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mirserver/Mir200/Envir/QuestDiary/更多版本下载Www.Uc955.Com.html
Size 371B
Sample241019-pvbq6swdrf
SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
MD5 d726adaaf77a5393dd5a4e76daed3df6
SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
512	msedge.exe
512	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 3920	512	msedge.exe	85
PID 512 wrote to memory of 3920	512	msedge.exe	85
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 1940	512	msedge.exe	86
PID 512 wrote to memory of 4100	512	msedge.exe	87
PID 512 wrote to memory of 4100	512	msedge.exe	87
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88
PID 512 wrote to memory of 5072	512	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mirserver\Mir200\Envir\QuestDiary\更多版本下载Www.Uc955.Com.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff916ed46f8,0x7ff916ed4708,0x7ff916ed4718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14398282735820246554,15506785457358798726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 5eb699be4198c6548aac1e4d4b924cdafee382c909bec91015bedc18df8c65a7
MD5 7281eb7371b9fae31c4e24a1a3c7f83b
SHA1 b4bf126adc9578a598ef152b2d67cbf16663b4cf
SHA512 ba32b0a9d7d16734f36a71c98fa9003449a19ebb9fee2bdbcdb8141185f6f2c21634ef5ad807dcfe8786024c122113793730027b302d4fff437a5bdf84bce658
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2d8a7f2b3e1a2c2bd33a7f8d48a64db0a2bd0fa93910e54f35235e57891290d8
MD5 551386978a6bc46bcc55520a06dc3f43
SHA1 688ffb1559799039756b7ca09d831fffc24ff34d
SHA512 4babbf0fcb1f08d18fc66ababeb33316b263d5785356c2beca4f0352fe7e0abe1a7fde2a1c94ba034f80353ae2fea9509d20b92054d669963217df5af399137d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 be8b6efada1ed3ac0b2ee8528604ad32826574410fb611baacb1b11e400b82d8
MD5 91dac5680a737341057406234fd3ecc6
SHA1 f4f0c1cbd587c0a188823d3ca7991190e8d45694
SHA512 107ffad8ab63c45f5b0598425e25d22ec24f405a79f9c38fe2efbefbeea5025c1e91a71f719baab59af3bf0b8e9191bc64823a469889aa67e05816fd1dc3fac4
SSDEEP 96:nMkcQ156SwpvWMoiVmdeHBjsJUWQyV+VDCziEwb:nMkJ/hGWMXBkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 962ef04dd8c3128234997789e962d41a8821f208769df4db2910ba6fa1f87c22
MD5 8db23b815f7be42975e88b5cc54c6416
SHA1 9938329ad52a2fd595a7626bd8a8243636900694
SHA512 39289a5e1f193fec83f42e7830396f3d2f16f09a41286b57734c2748e0d346025e961011e75afb55e211b4506dda31069137f7741d7775b847c4a79e96e79b47
SSDEEP 96:nMkGQ15BSwpvWMoiVmdeHBjsJUWQyV+VDCAiEwb:nMkT/cGWMXBkrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 27d76fa7a359eb209e881a8fd9b3fdff28d6684594b57402183550a494d7fdf5
MD5 32cff13fb5d5c40625389cc68380904b
SHA1 64fe029458533090108308c0dc08c04d0a31ee66
SHA512 2afc737bdba2a51b692d686b8389545b3a50e6767e9ea852644e1e59066daafb76417cf6cea3d8542acfe539f53efffc631e0211afabc4de64ea9ce30caa7775
SSDEEP 96:nMkGQ156SwpvWMoiVmdeHBjsJUWQyV+VDCAiEwb:nMkT/hGWMXBkrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e2418767be271b55b747a1b51af811b629e6448700646dbed6414ee19730da86
MD5 15d9eab560f030dda62f826712cd7f07
SHA1 3e663d8bf6a6ab86b004e36954fed65ae54b5dee
SHA512 e0390b420108cd2d1522ac407dc3f17bbbc4e45da5942080d4d009e94ce394e3f91c5b985cf2ed1f6dd19658d65d56f56810cabf89a3e9797f70371f75c4b54c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupte2RUSchQ1K3wbVGu:A9iIxuERzA83h09RZxYpI0KYGu
MD5 SHA1 SHA512 SSDEEP

Submit Download