Analysis
-
max time kernel
1680s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-11-2024 00:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1291101501355196509/1298433934111150101/Multi-PC-Cleaner.exe?ex=67314755&is=672ff5d5&hm=ae06b9a16de3615e03e72a982a32ea00e17639b9ae683fcc4be7981248d2ea4c&
Resource
win11-20241007-en
General
-
Target
https://cdn.discordapp.com/attachments/1291101501355196509/1298433934111150101/Multi-PC-Cleaner.exe?ex=67314755&is=672ff5d5&hm=ae06b9a16de3615e03e72a982a32ea00e17639b9ae683fcc4be7981248d2ea4c&
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 438537.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid Process 1124 msedge.exe 1124 msedge.exe 4952 msedge.exe 4952 msedge.exe 4908 identity_helper.exe 4908 identity_helper.exe 2812 msedge.exe 2812 msedge.exe 2904 msedge.exe 2904 msedge.exe 2904 msedge.exe 2904 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
msedge.exepid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 4952 wrote to memory of 3536 4952 msedge.exe 79 PID 4952 wrote to memory of 3536 4952 msedge.exe 79 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 4620 4952 msedge.exe 80 PID 4952 wrote to memory of 1124 4952 msedge.exe 81 PID 4952 wrote to memory of 1124 4952 msedge.exe 81 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82 PID 4952 wrote to memory of 2128 4952 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1291101501355196509/1298433934111150101/Multi-PC-Cleaner.exe?ex=67314755&is=672ff5d5&hm=ae06b9a16de3615e03e72a982a32ea00e17639b9ae683fcc4be7981248d2ea4c&1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc0903cb8,0x7ffcc0903cc8,0x7ffcc0903cd82⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:22⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 /prefetch:82⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:12⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11687843342096121773,4658347047930549875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5554d6d27186fa7d6762d95dde7a17584
SHA193ea7b20b8fae384cf0be0d65e4295097112fdca
SHA2562fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb
SHA51257d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7
-
Filesize
152B
MD5a28bb0d36049e72d00393056dce10a26
SHA1c753387b64cc15c0efc80084da393acdb4fc01d0
SHA256684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1
SHA51220940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7
-
Filesize
186B
MD5094ab275342c45551894b7940ae9ad0d
SHA12e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA256ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
SHA51219d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD594694663af4713f3314c305048532551
SHA1d48d86da37a992e8300fbe9adb95fc5e22f6fd88
SHA25614bfcb34df5ea25f4956b66ac627c4604f619fb02b5d5209bb73fe650070c55c
SHA51250e4cc9bb188efee4db59899967bfc431faa98a058e7f900dab6be04520a9bdd550e16fc9ac447d7e94ca53e53497e6db466d8cac7278ecd2a965f59d755e358
-
Filesize
5KB
MD5ceebafc5d287ea6e7e969feebd2db713
SHA19304135bda85d73528af2bb2f0b0b0164cdbf3ae
SHA2569d1f11c61f09651a652a6fcc9428a109f3133993e2f4a80e71cc9d3a216a4abb
SHA51290b59b03568749c3b68174e328697f38881a881b3be55309c4196b47f0c43d264eb6730d92fc690cd8ffe2ee0aa3caa7d6293ec728861d789a2707cda3c473d3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5877f00505302a7289b2a6aff58a355f1
SHA1b603eaa9bec005e6f4a08eb9f9dbcd1f82a98c29
SHA2569022463b153a012f383341607dc3a64a70ee50722354ea6436037f41f1d41e3d
SHA512cefea3d2f5e7d2fb946dbf938b90f0519933c66c4c5cc951fc312ac1433e42e3571190b07048088b9b5ee808f4d9d64a01b4ce15f9b2685b773a187100ff3955
-
Filesize
185KB
MD5edae297d98b1600a2be59807ae13fd7f
SHA12567e69cdeba797aca44ca528f393987a0395c22
SHA25681af4e961d7492c2f26fcc56488f4502dc3a8919130c873a02c8e543ffd8922a
SHA51281d22cb0542b88d7c5b7c82744b1587a7df3b62445616e452599e288fb28f6e587ecfc3b474286d4c8d32dc44c6a1934954689af213915bc3fef1845a88f4a7a