Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/11/2024, 21:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://x0.at/aGFA.zip
Resource
win11-20241007-en
General
-
Target
https://x0.at/aGFA.zip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1876 msedge.exe 1876 msedge.exe 1208 msedge.exe 1208 msedge.exe 1140 msedge.exe 1140 msedge.exe 4396 identity_helper.exe 4396 identity_helper.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 840 1208 msedge.exe 79 PID 1208 wrote to memory of 840 1208 msedge.exe 79 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 3520 1208 msedge.exe 80 PID 1208 wrote to memory of 1876 1208 msedge.exe 81 PID 1208 wrote to memory of 1876 1208 msedge.exe 81 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82 PID 1208 wrote to memory of 3780 1208 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://x0.at/aGFA.zip1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf9993cb8,0x7ffaf9993cc8,0x7ffaf9993cd82⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,16564300576199253597,4297908493609871109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3580
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54c1a24fa898d2a98b540b20272c8e47b
SHA13218bff9ce95b52842fa1b8bd00be073177141ef
SHA256bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95
SHA512e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e
-
Filesize
152B
MD5f1d2c7fd2ca29bb77a5da2d1847fbb92
SHA1840de2cf36c22ba10ac96f90890b6a12a56526c6
SHA25658d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5
SHA512ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14
-
Filesize
173B
MD55b76e70b9e9e3dd48100ca803e69cf31
SHA131a26dd5e809232449487d17561a652701cdea3c
SHA256b46c8f9d1cb5a9f6878ba8e965a07e3ae6a1c61d5baca8c8072a3e36c549438b
SHA512f603fdc913f91c6048d2435fc403e6f066b87ccccbaf13158b45db858347aed759a9fb784534a19e0b15089a4ab2705037126c0207fa20627142edf93995bc16
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD517f0fc5b4fc6d3d41b5ce2b3e9c97e57
SHA16b561737134965979505b1a45ca75ca603ea55db
SHA256275f0e5b1fc1b68c45670250b5ca4f87d6373d4484e087be77c0145df015b51f
SHA512514973b8dbf88de563ea6b5716a0ecfd69d4434ed056da9150c6af7ffe28336eca730570b8520e6dcc5a64ff95b76d5cc12be754a35da6a20988e53dd20782f7
-
Filesize
5KB
MD57dc2a9fc4f35863616b405d0871a7f35
SHA10ed02bf90dc10ba1b8274a0ae7654ed0ad146a36
SHA25633a19eb414bba8fc3f611aee19c85a9f242942019c45eb1dce442bf044816a16
SHA512078e32707f719034936e93f93ca8f794cdfe2bc03e2811d21e8ef9c63eb79f6e964b522817f47031c9050de473f768212748902cb79598274998511db21529f2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD55046bde69c1941c5ebf1127b664f5775
SHA1628184b99c3352b5007ef9f8e1dc2f32584f84ac
SHA256ce7d8ddb9fd6cbbc84e4cc0a0c38720d7ff496a2bf3ac455364478f08d33edef
SHA51293ec3d4a9909b4faa5e551aed363b74fdd1ba74ce3b3b6850a55cf21e9bac65a572e52a32e59494a56a46c75ce5befd085cfa9483ea63e66ea555c1c9b60f9ac