6792d2d35d1f2a9dbe58b8b1e98f05ba5419bf7775d1520410069715ed891038

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/list-viewer/assets/view.html
Size 8KB
Sample241107-maftaazlay
SHA256 6e493106f4507c03fcdbb645409366f3d5234c76f50554d8ae0de296169aa21a
MD5 128a67b76be2ac9d967b9af09b9762d2
SHA1 0540d99c715fabb3fe9945dff8c6be6d9ec1c8b3
SHA512 5a676caf9aec60e996e3159de969c77062a78d687d9dcc0ccde218cabc32d10d31c75572f68fff1dc0f11155ca13e41ba8e27c3c30c6c39f93baf78286831976
SSDEEP 192:+B+o+xFN+xFwv2Y4TONsRUkUqmZGxgrnc:+wFYFPY4S3Cgc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
4020	msedge.exe
4020	msedge.exe
556	identity_helper.exe
556	identity_helper.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2068	4020	msedge.exe	85
PID 4020 wrote to memory of 2068	4020	msedge.exe	85
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 4612	4020	msedge.exe	86
PID 4020 wrote to memory of 448	4020	msedge.exe	87
PID 4020 wrote to memory of 448	4020	msedge.exe	87
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88
PID 4020 wrote to memory of 3280	4020	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\RevokeMsgPatcher.v2.0\LiteLoaderQQNT\plugins\list-viewer\assets\view.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb948446f8,0x7ffb94844708,0x7ffb94844718
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,9660594347903277140,3278284291744710212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c2cef53db0df5d58cde61b5429758963aed7ea899a4a24f65b7d59cd07d4f537
MD5 c13a45891735356594657eac45fce2f4
SHA1 02ede0b9ed0f21d17d96ed442e99e0fe6977640b
SHA512 87538ff294712ed012a8111329756b21769f96904d69817f5af1a8440abaaf4b8d45e0b7ed4c9e87de93eb08794f9a49d28ae54d9bb6c735b78cd64f8dfd755d
SSDEEP 96:nXk2w1q41SnwpvWMoiVmdeHdwIUWQyV+VD7AiEwb:nXkjk6aGWMX7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 93725eeade774d03ebd7241e3d52dbc23b5c5db1f7ddc21c9c5bb30a32205588
MD5 838d6562d8e1cd5194a63fdd0c5b3058
SHA1 22d4fa42dd771f62d8c78d522d592e672793cb5d
SHA512 8accf9170a5834a0e1fb1cb2b8acba777afd33109487c1e1a6ad15308358eadc0638bd7cecdd5a2218b17eb2a359cebc3eadef2929a534efd143e5351ecaeec2
SSDEEP 96:nXksw1qR1SnwpvWMoiVmdeHdwIUWQyV+VDCziEwb:nXkpkzaGWMX7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e87ee3520e67cf7d8634ed8f1fa0bc5d8082ea3ef031f3f617be294f1c4ad8e4
MD5 48911d095bcf629b0fe3c6ca54909cd2
SHA1 5cd69c169f89e0fc2b219e2e7267c1ebf8071237
SHA512 30c7e2c17b9670bd793c0ce57987d19005da51fba85d0008f7f7c4bad6d9276c1ea10aa35730e76ff3c05f8a5bcec670913de40b895c8fba5c77f5839a54b283
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi2Xe2RUqRH0HqRUx3GPOxV:A9iIxuERzA83h09RZxYllnSFGmx8owTu
MD5 SHA1 SHA512 SSDEEP

Submit Download