367d1b3076da2962ad6f0479dfba30f3786854358509a1cac33dcaf071c4d428

Analysis

max time kernel
138s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Void Exec/bin/DebugMonaco/package/esm/vs/base/parts/quickinput/common/quickInput.js
Size

772B
MD5

c87dac46c7ebb329d4f7073efc247071
SHA1

df2c039b1911fc38b59a4ef6e295c6acbac91eed
SHA256

7df88b302637d756dc52621445c9e8041c1c4f3020fe11986ddae51cbcbcea64
SHA512

013c7515e2e704bdcce505e7f4fcd51dae8bfb37c4982c7e20b0126e25e783ff72ed53b3e6d51b3c578d4992d8092579bdce1ca48834f6ae1b1922b91a7457b4

Score

4^/10

discovery execution

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
4952	mspaint.exe
4952	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3396	4148	msedge.exe	112
PID 4148 wrote to memory of 3396	4148	msedge.exe	112
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 2528	4148	msedge.exe	113
PID 4148 wrote to memory of 1968	4148	msedge.exe	114
PID 4148 wrote to memory of 1968	4148	msedge.exe	114
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115
PID 4148 wrote to memory of 4484	4148	msedge.exe	115

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Void Exec\bin\DebugMonaco\package\esm\vs\base\parts\quickinput\common\quickInput.js"
1⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9d4d01cah4fbch44a8haad3h5e86b03c52b5
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaec5546f8,0x7ffaec554708,0x7ffaec554718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3728138947837628012,9016120524303513685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3728138947837628012,9016120524303513685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3728138947837628012,9016120524303513685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UndoTest.wmf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8dafd32ba56572eea041fe2e1a363b93

SHA1
4619165276d90614221ef4389ba8b733d36ff787

SHA256
a8ecb6285d632a2bc9144b78273770624b16d853ad3ee70bd60d02363e29fee5

SHA512
5856571cff1bd8403d84c307bbac76451c9d644d75c3f02f085cddd4331dc4dd0ab2dcc9956dfa8e7a1a20a772c9489d0dbc5e2823f8b4b955e0929c7a059733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
06ae0818eb14380c2af3b704c5e46d5c

SHA1
be568f81d7a1c548eae16fe7657f442626fac9a0

SHA256
06c9dc79af2909b9365b6ced40804d757ff8810ee5a778dd7b223915eb6bb182

SHA512
9e402ccf3f429182ce5e9101325f8d7374ea73e91c429ab4a62df46244782cc0c86f81934e2d61480cde5ef30c2f7fe3b52a25eb9378dbf42f16f20df4da5424

Download Submit